AO 93 (Rev. 1 i/13) Search and Seizure Warrant 
- ■ . = 


United States District Court 

for the 

District of Nevada 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

AMAZON ACCOUNT LINKED TO 
CENTRA! PARK1@LIVE.COM THAT IS STORED AT A 
PREMISES CONTROLLED BY AMAZON, INC. 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _*_District of _ Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A 


) 

) 

) Case No. 2:17-mj- -(^37 c 

) 

) 


1 find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


SEE ATTACHMENTS B and C 


YOU ARE COMMANDED to execute this warrant on or before .q)Q\ ( (not to exceed 14 day’s) 

n the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the w aijanj, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_|v )^VT 

□ Pursuant to 18 U.S.C. § 3103a(b), 1 find that immediate notification may 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _ 



Jnited States Magistrate Judge) 
have^n adverse result listed in 18 U.S.C. 





1 


ATTACHMENT “A” 


z ONLINE ACCOUNT TO BE SEARCHED 

3 

1. This warrant applies to information related to the Amazon.com account 

4 associated with centralparkl@live.com (the “Target Amazon Account”) from its inception 
to present, which is stored at premises owned, maintained, controlled, or operated by 

5 Amazon.com, Inc., headquartered at 300 Deschutes Way SW, Suite 304, Tumwater, WA 
98501. 
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ATTACHMENT “B” 



To the extent that the information described in Attachment A is within the possession, 
custody, or control ofAmazon.com, including any Emails, records, files, logs, or 
information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 

a. All names, addresses, email addresses, shipping addresses, and billing 
information associated with the Target Amazon Account; 

b. Date of account creation; 

c. All purchase history; 

d. Service usage information; 

e. All Internet Protocol Address logs and information; 

f. All messages and/or communications exchanged with Amazon.com 
representative; 

g. Any and all information, files, and data in possession of Amazon.com 
and/or any other entities controlled or operation by Amazon.com, Inc. 
related to the Target Amazon Account, 



After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present: 
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a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, fists of names, records of 
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payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. Information related to wire transfers and/or the movement, possession, or 
storage of currency and valuable items. 
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ATTACHMENT “C” 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 


part: 


Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 


(e) Issuing the Warrant. 


(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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SEALED 


Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 







21 1. Your Affiant makes this affidavit in support of an application for a search 

22 warrant for information related to the Amazon account associated with email account 

23 centralparkl@live.com (“Target Amazon Account”). The Target Amazon Account is 
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associated with STEPHEN PADDOCK and the information is stored at a premises 
owned, maintained, controlled, or operated by Amazon.com, Inc. (“Amazon”), an 
American electronic commerce and cloud computing company based in Tumwater, 
Washington. More generally, Amazon is a website that allows account holders to browse 
for and purchase a variety of goods. Separately, Amazon offers and provides internet- 
based cloud services to various individuals/entities. The information to be searched is 
described in the following paragraphs and in Attachment “A” (attached hereto and 
incorporated herein by reference). This affidavit is made in support of an application for 
a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A) to require 
Amazon to disclose to the government records and other information in its possession, 
pertaining to the subscriber or customer associated with the Target Amazon Account. 

2. I am an “investigative or law enforcement officer of the United States” 
within the meaning of Title 18, United States Code, Section 2510(7), that is, an officer of 
the United States who is empowered by law to conduct investigations of, and to make 
arrests for, offenses enumerated in Title 18, United States Code, Section 2516. 

3. I have been employed as a Special Agent of the FBI for approximately five 
years, which began at the FBI Academy in October 2012. Upon completion of the 
academy, I was transferred to the Las Vegas Division’s white collar crime squad and 
then the human trafficking squad. Since October 2015,1 have been assigned to the Las 
Vegas Division’s violent crime/gang squad. Additionally, I have been a certified member 
of the FBI’s Cellular Analysis Survey Team since August 2015 due to my expertise in 
the field of historical cell site analysis. 
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4. During my tenure with the FBI, I have conducted surveillance, analyzed 
telephone records, interviewed witnesses, supervised activities of sources, executed 
search warrants, executed arrest warrants, and participated in court-authorized 
interceptions of wire and electronic communications. These investigative activities have 
been conducted in conjunction with a variety of investigations, to include those involving 
robbery, drug trafficking, kidnapping, murder, criminal enterprises, and more. In 
addition to my practical experiences, I received five months of extensive law enforcement 
training at the FBI Academy. 

5. The facts in this affidavit are derived from your Affian t’s personal 
observations, his training and experience, and information obtained from other agents, 
detectives, and witnesses. This affidavit is intended to show merely that there is 
sufficient probable cause for the requested warrant and does not set forth all of the 
Affiant’s knowledge about this matter. 

6. Based on your Affiant’s training and experience and the facts as set forth 
in this affidavit, there is probable cause to believe that violations of: 

a. Destruction/Damage of Aircraft or Aircraft Facilities - 18 U.S.C.A § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee - 18 USC 922(a)(3) and (5). 

(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK and 

others yet unknown. There is also probable cause to search the information described in 

Attachment “A” for evidence of these crimes and information which might reveal the 
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identities of others involved in these crimes, as described in Attachment “B” (attached 
hereto and incorporated herein by reference). 
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PROBABLE CAUSE 

7. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

8. LVMPD officers ultimately made entiy into the room and located an 
individual later identified as STEPHEN PADDOCK. Paddock was deceased from an 
apparent self-inflicted gunshot wound. 

9. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 
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10. On October 2,2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms, Paddock’s vehicle at Mandalay Bay, and two Nevada residences owned 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammuni tion and 100 
pounds of explosive material were found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of a mm unition were located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

11. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

12. In an effort to determine whether or not STEPHEN PADDOCK was 
assisted and/or conspired with unknown individuals, investigators have attempted to 
identify all of STEPHEN PADDOCK’s communication facilities. Based on a review of his 
financial accounts, email address centralnarkl@live.com (‘Email Account”) was 
determined to belong to STEPHEN PADDOCK On October 3, 2017, investigators 
requested an emergency disclosure of records from Microsoft related to the Email 
Account so it could be searched for any evidence of additional co-conspirators. Within 
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the Email Account, investigators identified the Target Amazon Account as one that 
required further investigation. 

13. Numerous emails sent from Amazon to the Email Account were discovered 
in the Email Account which were addressed by Amazon to “Stephen” and listed 
STEPHEN PADDOCK’S residence in Mesquite, Nevada as the shipping destination. For 
these reasons in conjunction with the Target Amazon Account being associated with the 
Email Account, investigators strongly believe the Target Amazon Account was controlled 
and operated by STEPHEN PADDOCK. 

14. On September 7, 2017, the Email Account received an email relating to the 
Target Amazon Account’s purchase of an EOTech 512.A65 Tactical Holographic firearm 
accessory. Within the email, which was addressed to STEPHEN PADDOCK, Amazon 
confirmed the firearm accessory would be delivered to STEPHEN PADDOCK’s 
residence. Investigators believe this piece of equipment was utilized in the attack carried 
out by STEPHEN PADDOCK. 

15. Your Affiant believes the requested search warrant will yield significant 
information from Amazon such as STEPHEN PADDOCK’s search history, purchase 
history, IP addresses, shipping addresses, payment information, and more, which may 
constitute evidence of his planning of the attack and potentially identify other 
participants in the attack. Ultimately, your Affiant strongly believes the requested 
information will lead investigators to determine the full scope of STEPHEN PADDOCK’s 
plan and/or conspiracy. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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16. Your Affiant anticipates executing this warrant under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Amazon to disclose to the government 
copies of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “BUpon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items described in Section II of Attachment “B.” 

CONCLUSION 

17. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 

REQUEST FOR SEALING 

18. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 
the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
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cause to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 
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ATTACHMENT “A” 


ONLINE ACCOUNT TO BE SEARCHED 
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1. This warrant applies to information related to the Amazon.com account 
associated with centralparkl@live.com (the “Target Amazon Account”) from its inception 
to present, which is stored at premises owned, maintained, controlled, or operated by 
Amazon.com, Inc., headquartered at 300 Deschutes Way SW, Suite 304, Tumwater, WA 
98501. 
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ATTACHMENT “B” 



5 To the extent that the information described in Attachment A is within the possession, 
custody, or control ofAmazon.com, including any Emails, records, files, logs, or 

6 information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 

7 is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 
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a. All names, addresses, email addresses, shipping addresses, and billing 
information associated with the Target Amazon Account; 

b. Date of account creation; 

c. All purchase history; 

d. Service usage information; 

e. All Internet Protocol Address logs and information; 

f. All messages and/or communications exchanged with Amazon.com 
representative; 

g. Any and all information, files, and data in possession of Amazon.com 
and/or any other entities controlled or operation by Amazon.com, Inc. 
related to the Target Amazon Account. 
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After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); .37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present: 
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a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 


10 






payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. Information related to wire transfers and/or the movement, possession, or 
storage of currency and valuable items. 
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ATTACHMENT “C” 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SE IZE D 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information fisted as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessaiy to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2XA) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the ‘later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AO 93 {Rev 11/13) Search and Seizufe Warrant 


United States District Court 

for the 

District of Nevada 

In the Matter of the Search of 

(Briefly describe the properly to be searched 
or identify the person by name and address) 

ACCOUNT(S) ASSOCIATED WITH THE CELLULAR 
DEVICE BEARING IMEI 990006880858377 STORED 
AT A PREMISES CONTROLLED BY GOOGLE 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the___District of _ Nevada 

Cidenlify the person or describe the property to be searched and give its location)'. 

SEE ATTACHMENT A 


) 

) 

) Case No. 2:17 ‘ m j- ^‘7/ - 

) 

) 


1 find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 

described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS B and C 


YOU ARE COMMANDED to execute this warrant on or before (not to exceed 14 days) 

3\n the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, mpst prepare an inventory 

as required by law and promptly return this warrant and inventory to _ / /^y\tX-^\ ~ \ -• 

(United States Magistrate Judge) 

rj Pursuant to 18 U.S.C. § 3103a(b), 1 find that immediate notification may have an adVerse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30j D until, the facts justifying, the later specific date of_. 


Date and time issued: 


City and stale: 



Las Vegas, Nevada 
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ATTACHMENT “A” 


ONLINE ACCOUNT TO BE SEARCHED 

1- This warrant applies to information related to the Google account 
associated with the cellular device bearing IMEI 990006880858377 (the “Target 
Account”) from its inception to present, which is stored at premises owned, maintained, 
controlled, or operated by Google, Inc., headquartered at 1600 Amphitheatre Way, 
Mountain View, California, 94043. 
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ATTACHMENT “B” 

Particular Things to be Seized 

I. Information to be disclosed bv the Service Provider 

To the extent that the information described in Attachment A is within the 
possession, custody, or control of Google, including any Emails, records, files, logs, or 
information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 

a. The contents of all messages and emails associated with the account, 
including copies of messages and emails sent to and from the account, draft 
messages/emails, the source and destination addresses associated with 
each message/email, the date and time at which each message/email was 
sent, and the size and length of each message/email; 

b. All records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other 
identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means 
and source of payment (including any credit or bank account number); 

c. All records or other information stored in the Online Accounts, including 
address books, contact and buddy lists, calendar data, pictures, 
applications, documents, and other files; 

d. All records pertaining to communications between Service Provider and 
any person regarding the account, including contacts with support services 
and records of actions taken. 

e. All data and contents related to the following Google Services associated 
with the Target Account: Android; Gmail; Google Calendar; Google Docs; 
Google Drive; Google Talk; Multilogin; Web History; YouTube; and all other 
applications. 

f. All information and content associated with any third-party application 
associated with the Target Account and the dates when the applications 
were installed; 
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g. Based on an analysis of cookies assigned to computers and devices that 
accessed the Target Account, identify all other Google accounts that have 
been accessed from any computers and devices that have logged into the 
Target Account. 

II. Information to be seized bv the United States 

After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present; 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy fists. 
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ATTACHMENT “C” 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data fisted as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 


a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 
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b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 
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c. surveying various file directories and the individual files they contain; 
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d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 
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(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be. copied onto appropriate media and returned to the 
person from whom the information was seized. 
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STEVEN W. MYHRE 

Acting United States Attorney 

District of Nevada 

CRISTINA D. SILVA 

PATRICK BURNS 

Assistant United States Attorneys 

501 Las Vegas Blvd. South, Ste. 1100 

Las Vegas, Nevada 89101 

Telephone: (702) 388-6336 

Fax (702) 388-6698 

iohn.p.burns@usdoi.gov 

Attorney for the United States of America 


UNITED STATES DISTRICT COURT 
DISTRICT OF NEVADA 
-oOo- 


IN THE MATTER OF THE SEARCH OF 
INFORMATION RELATED TO THE 
ACCOUNT(S) ASSOCIATED WITH THE 
CELLULAR DEVICE BEARING IMEI 
990006880858377 THAT IS STORED AT 
A PREMISES CONTROLLED BY 
GOOGLE. 


Magistrate No. 




AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH 
WARRANT 


(Under Seal) 


STATE OF NEVADA ) 

) ss: 

COUNTY OF CLARK ) 

AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 

I, Ryan S. Burke, Special Agent, Federal Bureau of Investigation (FBI), having 

been duly sworn, hereby depose and say: 

INTRODUCTION AND AGENT BACKGROUND 

1. Your Affiant makes this affidavit in support of an application for a search 
warrant for information related to the Google account(s) associated with the cellular 
device bearing IMEI 990006880858377 [“Target Account(s)”], which are associated with 
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STEPHEN PADDOCK. This information is stored at a premises owned, maintained, 
controlled, or operated by Google, Inc. (“Google”), an American multinational technology 
based in Mountain View, California that specializes in Internet-related services and 
products. Those services include, but are not limited to, online advertising technologies, 
a search engine, email services, cloud computing, and many other services. The 
information to be searched is described in the following paragraphs and in Attachment 
“A” (attached hereto and incorporated herein by reference). This affidavit is made in 
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), 
and 2703(c)(1)(A) to require Google to disclose to the government records and other 
information in its possession, pertaining to the subscriber or customer associated with 
the Target Account. 

2. I am an “investigative or law enforcement officer of the United States” 
within the meaning of Title 18, United States Code, Section 2510(7), that is, an officer of 
the United States who is empowered by law to conduct investigations of, and to make 
arrests for, offenses enumerated in Title 18, United States Code, Section 2516. 

3. I have been employed as a Special Agent of the FBI for approximately five 
years, which began at the FBI Academy in October 2012. Upon completion of the 
academy, I was transferred to the Las Vegas Division’s white collar crime squad and 
then the human trafficking squad. Since October 2015,1 have been assigned to the Las 
Vegas Division’s violent crime/gang squad. Additionally, I have been a certified member 
of the FBI’s Cellular Analysis Survey Team since August 2015 due to my expertise in 
the field of historical cell site analysis. 
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4. During my tenure with the FBI, I have conducted surveillance, analyzed 
telephone records, interviewed witnesses, supervised activities of sources, executed 
search warrants, executed arrest warrants, and participated in court-authorized 
interceptions of wire and electronic communications. These investigative activities have 
been conducted in conjunction with a variety of investigations, to include those involving 
robbery, drug trafficking, kidnapping, murder, criminal enterprises, and more. In 
addition to my practical experiences, I received five months of extensive law enforcement 
training at the FBI Academy. 

5. The facts in this affidavit are derived from your Affiant’s personal 
observations, his training and experience, and information obtained from other agents, 
detectives, and witnesses. This affidavit is intended to show merely that there is 
sufficient probable cause for the requested warrant and does not set forth all of the 
Affiant’s knowledge about this matter. 

6. Based on your Affiant’s training and experience and the facts as set forth 
in this affidavit, there is probable cause to believe that violations of: 

a. Destruction/Damage of Aircraft or Aircraft Facilities -18 U.S.C.A. § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee - 18 U.S.C. §§ 922(a)(3) and (5); 

(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK and 

others yet unknown. There is also probable cause to search the information described in 

Attachment “A” for evidence of these crimes and information which might reveal the 
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identities of others involved in these crimes, as described in Attachment “B” (attached 
hereto and incorporated herein by reference). 

PROBABLE CAUSE 

7. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

8. LVMPD officers ultimately made entiy into the room and located an 
individual later identified as Stephen Paddock. Paddock was deceased from an apparent 
self-inflicted gunshot wound. 

9. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 
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10. On October 2,2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms. Paddock’s vehicle at Mandalay Bay, and two Nevada residences owed 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammunition and 100 
pounds of explosive material was found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of ammunition was located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

11. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

12. During the execution of the search warrant at the Mandalay Bay hotel room 
where the attack occurred, three cellular phones were seized. All of the phones are 
believed to have belonged to STEPHEN PADDOCK. Two of those phones were unlocked 
and able to be forensically examined. Neither phone contained significant information 
that allowed investigators to determine the full scope of STEPHEN PADDOCK’S 
planning and preparation for the attack. The other phone, however, a ZTE Model 
Z837VL bearing IMEI 990006880858377, was locked and investigators do not believe it 
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can be forensically examined. Investigators believe the only way to gain access to the 
content of the locked ZTE phone will be through the authorization to dem an d 
information associated with the Target Account from Google, the company which owns 
the operating system software installed on the phone. 

13. Your Affiant knows through training and experience that criminals 
typically make effort to secure and keep hidden information that may incriminate 
themselves or others. Due to the fact that two of the cellular phones were unlocked and 
the cellular phone associated with the Target Account was locked, your Affiant believes 
if there were any information related to a potential conspiracy it would be found within 
the Target Account. 

14. Your Affiant believes the requested search warrant will yield significant 
information from Google such as STEPHEN PADDOCK’S contact fist, email message 
content, IP address usage, photographs, third-party applications, and more, which may 
constitute evidence of his planning of the attack and potentially identify other 
participants in the attack. Ultimately, your Affiant strongly believes the requested 
information will lead investigators to determine the full scope of STEPHEN PADDOCK’S 
plan. 

RELEVANT TECHNICAL TERMS 

15. The following non-exhaustive list of definitions applies to this Affidavit and 
the Attachments to this Affidavit: 

a. The ‘Internet” is a worldwide network of computer systems operated 
by governmental entities, corporations, and universities. In order to access the Internet, 
an individual computer user must subscribe to an access provider, which operates a host 
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|| computer system with direct access to the Internet. The World Wide Web is a 
functionality of the Internet which allows users of the Internet to share information. 

b. “Internet Service Providers” are companies that provide access to the 
Internet. ISPs can also provide other services for their customers including website 
hosting, email service, remote storage, and co-location of computers and other 
communications equipment. ISPs offer different ways to access the Internet including 
telephone-based (dial-up), broadband-based access via a digital subscriber line (DSL) or 
cable television, dedicated circuits, or satellite-based subscription. ISPs typically charge 
a fee based upon the type of connection and volume of data (bandwidth). Many ISPs 
assign each subscriber an account name, such as a user name, an email address, and an 
email mailbox, and the subscriber typically creates a password for his/her account. 

c. “ISP Records” are records maintained by ISPs pertaining to their 
subscribers (regardless of whether those subscribers are individuals or entities). These 
records may include account application information, subscriber and billing information, 
account access information (often in the form of log files), emails, information concerning 
content uploaded and/or stored on the ISP’s servers, and other information, which may 
be stored both in computer data format and in written or printed record format. ISPs 
reserve and/or maintain computer disk storage space on their computer system for their 
subscribers’ use. This service by ISPs allows for both temporary and long-term storage 
of electronic communications and many other types of electronic data and files. 

d. “Online service providers” (also referred to here as “service 
providers”) are companies that provide online services such as email, chat or instant 
messaging, word processing applications, spreadsheet applications, presentation 
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1 applications similar to PowerPoint, online calendar, photo storage and remote storage 

2 services. Sometimes they also can provide web hosting, remote storage, and co-location 

3 of computers and other communications equipment. Typically, each service provider 

4 assigns each subscriber an account name, such as a user name or screen name and the 

5 subscriber typically creates a password for his/her account. 

6 e. “Computer,” as used herein, is defined as “an electronic, magnetic, 

7 optical, electrochemical, or other high speed data processing device performing logical or 

8 storage functions, and includes any data storage facility or communications facility 

9 directly related to or operating in conjunction with such device.” 

10 f. A “server” is a centralized computer that provides services for other 

LI computers connected to it via a network. The other computers attached to a server are 

L2 sometimes called “clients.” For example, in a large company, it is common for individual 

L3 employees to have client computers at their desktops. When the employees access their 

L4 email, or access files stored on the network itself, those files are pulled electronically 

L5 from the server, where they are stored, and are sent to the client’s computer via the 

L6 network. Notably, servers can be physically stored in any location: it is not uncommon 

L7 for a network’s server to be located hundreds (and even thousands) of miles away from 

the client computers. 

g. “Internet Protocol address,” or “IP address,” refers to a unique 
number used by a computer to access the Internet. IP addresses can be dynamic, 
meaning that the Internet Service Provider (ISP) assigns a different unique number to 
a computer every time it accesses the Internet. IP addresses might also be static, that 
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is, an ISP assigns a user’s computer a particular IP address which is used each time the 
computer accesses the Internet. 

h. The term * domain” refers to a word used as a name for computers, 
networks, services, etc. A domain name typically represents a website, a server computer 
that hosts that website, or even some computer (or other digital device) connected to the 
internet. Essentially, when a website (or a server computer that hosts that website) is 
connected to the internet, it is assigned an IP address. Because IP addresses are difficult 
for people to remember, domain names are instead used because they are easier to 
remember than IP addresses. Domain names are formed by the rules and procedures of 
the Domain Name System (DNS). A common top level domain under these rules is “.com” 
for commercial organizations, “.gov” for the United States government, and “.org” for 
organizations. For example, www.usdoi.gov is the domain name that identifies a server 
used by the U.S. Department of Justice, and which uses IP address of 149.101.46.71. 

i. “Web hosting services” maintain server computers connected to the 
Internet. Their customers use those computers to operate websites on the Internet. 
Customers of web hosting companies place files, software code, databases, and other data 
on servers. To do this, customers typically connect from their own computers to the 
server computers across the Internet. 

j. The term “Whols” lookup refers to a search of a publicly available 
online database that lists information provided when a domain is registered or when an 
IP address is assigned. 

k. The terms “communications,” “records,” “documents,” “programs,” or 
“materials” include all information recorded in any form, visual or aural, and by any 
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means, whether in handmade form (including, but not limited to, writings, drawings, 
paintings), photographic form (including, but not limited to, pictures or videos), or 
electrical, electronic or magnetic form, as well as digital data files. These terms also 
include any applications (i.e. software programs). These terms expressly include, among 
other things, emails, instant messages, chat logs, correspondence attached as to emails 
(or drafts), calendar entries, buddy lists. 

l. “Chat” is usually a real time electronic communication between two 
or more individuals. Unlike email, which is frequently sent, then read and responded to 
minutes, hours, or even days later, chats frequently involve an immediate conversation 
between individuals, similar to a face-to-face conversation. Nearly all chat programs are 
capable of saving the chat transcript, to enable users to preserve a record of the 
conversation. By default, some chat programs have this capability enabled, while others 
do not. Many popular web-based email providers, like Google and Google, provide chat 
functionality as part of the online services they provide to account holders. 

m. “Apps or Applications” are third-party programs that may be 
installed through the Android operating system, which is owned by Google, for use on a 
cellular device. 

FACTS ABOUT GOOGLE 

16. In my training, my experience and this investigation, I have learned that 
Google owns and operates Android OS, which is an operating system found on many 
cellular devices to include the device associated with the Target Account. Through this 
operating system, users can install applications with a variety of functionalities, such as 
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various social media websites, mapping software, banking portals, etc. Records of the 

2 applications installed on a specific device are maintained by Google. 

3 17. In my training and experience, evidence of which applications were utilized 

4 by a specific device can be useful in identifying additional communication facilities, 

5 content of communications, financial account information, information related to whom 

6 the user associates with, and more. Oftentimes, an individual utilizing a Google account 
has the option to store certain information located on the device to a cloud, which Google 
also retains. All of this information can help investigators locate evidence of various 


criminal activity associated with the user. 








18. Your Affiant anticipates executing this warrant under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Google to disclose to the government copies 
of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “B.” Upon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items d escribed in Section II of Attachment “B.” 

CONCLUSION 

19. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
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18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 

REQUEST FOR SEALING 

20. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 
the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
cause to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 


Respectfully Submitted, 



Ryan S. Burke, Special Agent 
Federal Bureau of Investigation 


SWORN TO AND SUBSCRIBED 
before me this /J^av of October 2017. 
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ATTACHMENT “A” 
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ONLINE ACCOUNT TO BE SEARCHED 

1. This warrant applies to information related to the Google account 
associated with the cellular device bearing IMEI 990006880858377 (the “Target 
Account”) from its inception to present, which is stored at premises owned, maintained, 
controlled, or operated by Google, Inc., headquartered at 1600 Amphitheatre Way, 
Mountain View, California, 94043. 
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ATTACHMENT “B” 
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To the extent that the information described in Attachment A is within the 
possession, custody, or control of Google, including any Emails, records, files, logs, or 
information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 
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a. The contents of all messages and emails associated with the account, 
including copies of messages and emails sent to and from the account, draft 
messages/emails, the source and destination addresses associated with 
each message/email, the date and time at which each message/email was 
sent, and the size and length of each message/email; 

b. All records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other 
identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means 
and source of payment (including any credit or bank account number); 

c. All records or other information stored in the Online Accounts, including 
address books, contact and buddy fists, calendar data, pictures, 
applications, documents, and other files; 

d. All records pertaining to communications between Service Provider and 
any person regarding the account, including contacts with support services 
and records of actions taken. 

e. All data and contents related to the following Google Services associated 
with the Target Account: Android; Gmail; Google Calendar; Google Docs; 
Google Drive; Google Talk; Multilogin; Web History; YouTube; and all other 
applications. 

f. All information and content associated with any third-party application 
associated with the Target Account and the dates when the applications 
were installed; 
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g. Based on an analysis of cookies assigned to computers and devices that 
accessed the Target Account, identify all other Google accounts that have 
been accessed from any computers and devices that have logged into the 
Target Account. 

II. Information to be seized bv the United States 

After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present: 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy fists. 
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ATTACHMENT “C” 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or enciypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is enciypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized fist of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)( 1 )(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AFFIDAVIT IN SUPPORT O 


APPLICATION FOR SEARCH WARRANTS 


I, Zachary C. Mckinney, Special Agent, Federal Bureau of Investigation (FBI), 
having been duly sworn, hereby depose and say: 

INTRODUCTION AND AGENT BACKGROUND 


1. Your Affiant makes this affidavit in support of an application for search 
warrants for information associated with email accounts centralnark l@live.com (“Target 
Account 1”) and marilouroses@live.com (“Target Account 2”). Target Account 1 is an 
9 II account associated with STEPHEN PADDOCK Target Account 2 is an account 

10 associated with MARILOU DANLEY. The information associated with both accounts is 

11 stored at a premises owned, maintained, controlled, or operated by Microsoft 

12 Corporation (“Microsoft”), an American multinational technology company based in 

1 3 A Redmond, Washington that specializes in Internet-related services and products along 

14 I with the development and manufacturing of computer-related items. Those online 
1^ services include, but are not limited to, email services, cloud computing, and many other 
13 I services. The information to be searched is described in the following paragraphs and in 

Attachment “A” (attached hereto and incorporated herein by reference). This affidavit is 
|| made in support of an application for search warrants under 18 U.S.C. §§ 2703(a), 

19 I 2703(b)(1)(A), and 2703(c)(1)(A) to require Microsoft to disclose to the government 

20 records and other information in its possession, pertaining to the subscriber or customer 

21 associated with the Target Accounts. 

22 2. I am a Special Agent with the Federal Bureau of Investigation, currently 

23 assigned to Las Vegas, Nevada. I have been employed as a Special Agent of the FBI since 
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March of 2017. Over the course of my employment with the FBI, I have conducted 
surveillance, analyzed telephone records, interviewed witnesses, supervised activities of 
sources, executed search warrants, and executed arrest warrants. These investigative 
activities have been conducted in conjunction with a variety of investigations, to include 
those involving robbery, drug trafficking, human trafficking, criminal enterprises, and 
more. In addition to my practical experiences, I received five months of extensive law 
enforcement training at the FBI Academy. Previous to the FBI, I was employed as a 
human intelligence gatherer with the United States Army. I was trained extensively in 
interrogation, interview, and source hand l i n g techniques and best practices. I also 
received an MBA in International Business and worked with ExxonMobil as a financial 
manager. 

3. I make this affidavit in support of an application for a search warrant for 
information associated with the Microsoft accounts associated with 
centralparkl@live.com” and “marilouroses@live.com,” which is stored at a premises 
owned, maintained, controlled, or operated by Microsoft Corporation, headquartered at 
One Microsoft Way, Redmond, WA 98052-6399, hereinafter referred to as “premises,” 
and further described in Attachments A-1 and A-2 hereto. 

a. Destruction/Damage of Aircraft or Aircraft Facilities - 18 U.S.CA.. § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee - 18 U.S.C. §§ 922(a)(3) and (5); 

d. Aiding and Abetting — 18 U.S.C. § 2. 
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(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK, 
MARILOU DANLEY, and others yet unkn own. There is also probable cause to search 
the information described in Attachment “A” for evidence of these crimes and 
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information which might reveal the identities of others involved in these crimes, as 
described in Attachment “B” (attached hereto and incorporated herein by reference). 

PROBABLE CAUSE 

4. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

5. LVMPD officers ultimately made entry into the room and located an 
individual later identified as Stephen Paddock. Paddock was deceased from an apparent 
self-inflicted gunshot wound. 

6. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
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located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 

7. On October 2, 2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms, Paddock’s vehicle at Mandalay Bay, and two Nevada residences owed 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammunition and 100 
pounds of explosive material was found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of ammunition was located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

8. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

9. In an effort to determine whether or not STEPHEN PADDOCK was 
assisted and/or conspired with unknown individuals, investigators have attempted to 
identify all of STEPHEN PADDOCK’s associated. It was quickly determined that a 
casino player’s card in the name of MARILOU DANLEY was located in the room at the i 
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time of the attack. She has been identified thus far as the most likely person who aided 
or abetted STEPHEN PADDOCK based on her informing law enforcement that her 
fingerprints would likely be found on the ammunition used during the attack. 
Subsequently, investigators worked to identify the communication facilities utilized by 
STEPHEN PADDOCK and MARILOU DANLEY. 

10. Based on a review of STEPHEN PADDOCKs financial accounts, Target 
Account 1 was determined to belong to STEPHEN PADDOCK On October 3, 2017, 
investigators requested an emergency disclosure of records from Microsoft related to 
Target Account 1 so it could be immediately searched for any evidence of additional co- 
conspirators. Unfortunately, the information was only requested for a six-month 
timeframe. Within the account, investigators identified Target Account 2 as one that 
belonged to MARILOU DANLEY, which was clear based on the communications 
between the two email accounts. In an interview, DANLEY stated that PADDOCK had 
access to one of her email accounts, which investigators believe to be Target Account 2. 

11. On September 25, 2017, an email was exchanged between the Target 
Accounts which discussed a wire transfer of funds which was to be sent by STEPHEN 
PADDOCK to MARILOU DANLEY. It is unclear what the purpose of the wire transfer 
was, but MARILOU DANLEY is known to have been in the Philippines at the time. 

12. Additionally, on July 6, 2017, Target Account 1 sent an email to 
centralDark4804@gmail.com which read, “try an ar before u buy. we have huge selection, 
located in the las vegas area” Later that day, an email was received back from 
centralpark4804@gmail.com to Target Account 1 that read, “we have a wide variety of 
optics and ammunition to try.” And lastly, Target Account 1 later sent an email to 
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contact lists, email messages content, IP address usage, photographs, third-party 
applications associated with the account, and more, which may constitute evidence of 
the planning of the attack and potentially identify other participants in the attack. 
Ultimately, your Affiant strongly believes the requested information will lead 
investigators to determine the full scope of STEPHEN PADDOCK’S plan and MARILOU 
OAKLEY’S possible involvement. 

14. Investigators have previously sought and obtained a search warrant to 
examine the contents of both Target Accounts 1 and 2. After execution of that warrant, 
however, it became apparent and was confirmed with Microsoft that Microsoft was 
refusing to provide data related to/contained in the OneDrive online storage files for 
either account. Microsoft indicated to investigators that it did not believe such 
information was encompassed by the items to be produced that were specified in the 
original warrant. Investigators believe therefore that there is additional evidence 
Microsoft currently possesses that relates to the OneDrive online storage service, as well 
as potentially in a suite of other online services that Microsoft offers, including Office 
365, Windows Live Mail, Windows Live Writer, Windows Photo Gallery, Windows Live 
Messenger, Microsoft Family Safety, and Microsoft Outlook Hotmail Connector. Thus, 
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your Affiant seeks more specific authorization to seize and search the OneDrive and 
other sendee data specified in Attachment B of the instant warrant application. 

RELEVANT TECHNICAL TERMS 

15. The following non-exhaustive list of definitions applies to this Affidavit and 
the Attachments to this Affidavit: 

a. The “Internet” is a worldwide network of computer systems operated 
by governmental entities, corporations, and universities. In order to access the Internet, 
an individual computer user must subscribe to an access provider, which operates a host 
computer system with direct access to the Internet. The World Wide Web is a 
functionality of the Internet which allows users of the Internet to share information. 

b. “Internet Service Providers” are companies that provide access to the 
Internet. ISPs can also provide other services for their customers including website 
hosting, email service, remote storage, and co-location of computers and other 
communications equipment. ISPs offer different ways to access the Internet including 
telephone-based (dial-up), broadband-based access via a digital subscriber line (DSL) or 
cable television, dedicated circuits, or satellite-based subscription. ISPs typically charge 
a fee based upon the type of connection and volume of data (bandwidth). Many ISPs 
assign each subscriber an account name, such as a user name, an email address, and an 
email mailbox, and the subscriber typically creates a password for his/her account. 

c. “ISP Records” are records maintained by ISPs pertaining to their 
subscribers (regardless of whether those subscribers are individuals or entities). These 
records may include account application information, subscriber and billing information, 
account access information (often in the form of log files), emails, information concerning 
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content uploaded and/or stored on the ISP’s servers, and other information, which may 
be stored both in computer data format and in written or printed record format- ISPs 
reserve and/or maintain computer disk storage space on their computer system for their 
subscribers’ use. This service by ISPs allows for both temporary and long-term storage 
of electronic communications and many other types of electronic data and files. 

d. “Online service providers” (also referred to here as “service 
providers”) are companies that provide online services such as email, chat or instant 
messaging, word processing applications, spreadsheet applications, presentation 
applications similar to PowerPoint, online calendar, photo storage and remote storage 
services. Sometimes they also can provide web hosting, remote storage, and co-location 
of computers and other communications equipment. Typically, each service provider 
assigns each subscriber an account name, such as a user name or screen name and the 
subscriber typically creates a password for his/her account. 

e. “Computer,” as used herein, is defined as “an electronic, magnetic, 
optical, electrochemical, or other high speed data processing device performing logical or 
storage functions, and includes any data storage facility or communications facility 
directly related to or operating in conjunction with such device.” 

f. A “server” is a centralized computer that provides services for other 
computers connected to it via a network. The other computers attached to a server are 
sometimes called “clients ” For example, in a large company, it is common for individual 
employees to have client computers at their desktops. When the employees access their 
email, or access files stored on the network itself, those files are pulled electronically 
from the server, where they are stored, and are sent to the client’s computer via the 
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1 network. Notably, servers can be physically stored in any location: it is not uncommon 

2 for a network’s server to be located hundreds (and even thousands) of miles away from 

3 the client computers. 

g. “Internet Protocol address,” or “IP address,” refers to a unique 
number used by a computer to access the Internet. IP addresses can be dynamic, 
meaning that the Internet Service Provider (ISP) assigns a different unique number to 
a computer every time it accesses the Internet. IP addresses might also be static, that 
is, an ISP assigns a user’s computer a particular IP address which is used each time the 
computer accesses the Internet. 

h. The term “domain” refers to a word used as a name for computers, 
networks, services, etc. A domain name typically represents a website, a server computer 


12 | that hosts that website, or even some computer (or other digital device) connected to the 
internet. Essentially, when a website (or a server computer that hosts that website) is 
connected to the internet, it is assigned an IP address. Because IP addresses are difficult 
for people to remember, domain names are instead used because they are easier to 
remember than IP addresses. Domain names are formed by the rules and procedures of 
the Domain Name System (DNS). A common top level domain under these rules is “.com” 
for commercial organizations, “.gov” for the United States, government, and “.org” for 
organizations. For example, www.usdoi.gov is the domain name that identifies a server 
used by the U.S. Department of Justice, and which uses IP address of 149.101.46.71. 

i. “Web hosting services” maintain server computers connected to the 
Internet. Their customers use those computers to operate websites on the Internet. 
Customers of web hosting companies place files, software code, databases, and other data 
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on servers. To do this, customers typically connect from their own computers to the 
server computers across the Internet. 

j. The term “Whols” lookup refers to a search of a publicly available 
online database that lists information provided when a domain is registered or when an 
IP address is assigned. 

k. The terms “communications,” “records,” “documents,” “programs,” or 
“materials” include all information recorded in any form, visual or aural, and by any 
means, whether in handmade form (including, but not limited to, writings, drawings, 
paintings), photographic form (including, but not limited to, pictures or videos), or 
electrical, electronic or magnetic form, as well as digital data files. These terms also 
include any applications (i.e. software programs). These terms expressly include, among 
other things, emails, instant messages, chat logs, correspondence attached as to emails 
(or drafts), calendar entries, buddy lists. 

l. “Chat” is usually a real time electronic communication between two 
or more individuals. Unlike email, which is frequently sent, then read and responded to 
minutes, hours, or even days later, chats frequently involve an imm ediate conversation 
between individuals, similar to a face-to-face conversation. Nearly all chat programs are 
capable of saving the chat transcript, to enable users to preserve a record of the 
conversation. By default, some chat programs have this capability enabled, while others 
do not. Many popular web-based email providers, like Microsoft and Microsoft, provide 
chat functionality as part of the online services they provide to account holders. 

Ill 

III 
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FACTS ABOUT EMAIL PROVIDERS 

16. In my training, my experience and this investigation, I have learned that 
Microsoft; (the Service Provider) is a company that provides free web-based Internet 
email access to the general public, and that stored electronic communications, including 
opened and unopened email for Microsoft subscribers may be located on the computers 
of Microsoft. I have also learned that Microsoft Inc. provides various on-line service 
messaging services to the general public. Instant Messaging (“IM”) is a form of real-time 
direct text-based communication between two or more people using shared clients. The 
text is conveyed via devices connected over a network such as the Internet. In addition 
to text, Microsoft’s software allows, users with the most current updated versions to 
utilize its webcam service. This option enables users from distances all over the world to 
view others who have installed a webcam on their end. Thus, the Service Provider’s 
servers will contain a wide variety of the subscriber’s files, including emails, address 
books, contact or buddy lists, calendar data, pictures, chat logs, and other files. 

17. To use these services, subscribers register for online accounts like the 
Target Accounts. During the registration process, service providers such as the ones here 
ask subscribers to provide basic personal information. This information can include the 
subscriber’s full name, physical address, telephone numbers and other identifiers, 
alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit card or bank account number). Based on my training and my 
experience, I know that subscribers may insert false information to conceal their 
identity; even if this proves to be the case, however, I know that this information often 
provide clues to their identity, location or illicit activities. 
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18. In general, when a subscriber receives an email, it is typically stored in the 
subscriber’s “mail box” on that service provider’s servers until the subscriber deletes the 
Email. If the subscriber does not delete the message, the message (and any attachments) 
can remain on that service provider’s servers indefinitely. 

19. Similarly, when the subscriber sends an email, it is initiated at the 
subscriber’s computer, transferred via the Internet to the service provider’s servers, and 
then transmitted to its end destination. That service provider often saves a copy of the 
email sent. Unless the sender of the email specifically deletes the Email from the 
provider’s server, the email can remain on the system indefinitely. 

20. A sent or received email typically includes the content of the message, 
source and destination addresses, the date and time at which the email was sent, and 
the size and length of the email. If an email user writes a draft message but does not 
send it, that message may also be saved by that service provider, but may not include all 
of these categories of data. 

21. Just as a computer on a desk can be used to store a wide variety of files, so 
can online accounts, such as the accounts subject to this application. First, subscribers 
can store many types of files as attachments to emails in online accounts. Second, 
because service providers provide the services listed above (e.g. word processing, 
spreadsheets, pictures), subscribers who use these services usually store documents on 
servers maintained and/or owned by service providers. Thus, these online accounts often 
contain documents such as pictures, audio or video recordings, logs, spreadsheets, 
applications and other files. 


13 










1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


22. Reviewing files stored in online accounts raises many of the same 
difficulties as with reviewing files stored on a local computer. For example, based on my 
training, my experience and this investigation, X know that subscribers of these online 
services can conceal their activities by altering files before they upload them to the online 
service. Subscribers can change file names to more innocuous sounding names (e.g. 
renaming “FraudRecords.doc” to “ChristmasList.doc”), they can change file extensions 
to make one kind of file appear like a different type of file (e.g. changing the spreadsheet 
“StolenCreditProfiles.xls” to “FamilyPhoto.jpg” to appear to be a picture file, where the 
file extension “.xls” denotes an Excel spreadsheet file and “.jpg” a JPEG format image 
file), or they can change the times and dates a file was last accessed or modified by 
changing a computer’s system time/date and then uploading that file to the Online 
Accounts. Thus, to detect any files that the subscriber may have concealed, agents will 
need to review all of the files in the Target Accounts; they will, however, only seize the 
items that the Court authorizes to be seized. Similarly, subscribers can conceal their 
activities by encrypting files. Thus, these files may need to be decrypted to detect 
whether it constitutes an Item to be Seized. 

23. I also believe that people engaged in crimes such as the one described 
herein often use online accounts because they give people engaged in these crimes a way 
to easily communicate with other co-conspirators. Moreover, online accounts are easily 
concealed from law enforcement. Unlike physical documents, electronic documents can 
be stored in a physical place far away, where they axe less likely to be discovered. 

24. Service providers typically retain certain transactional information about 
the creation and use of each account on their systems. This information can include the 
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date on which the account was created, the length of service, records of log*in (i.e., 
session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the 
account (such as logging into the account via websites controlled by the Service 
Provider), and other log files that reflect usage of the account. In addition, service 
providers often have records of the Internet Protocol address (“IP address”) used to 
register the account and the IP addresses associated with particular logins to the 
account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to 
access the online account. 

25. In some cases, subscribers will communicate directly with a service 
provider about issues relating to the account, such as technical problems, billing 
inquiries, or complaints from or about other users. Service providers typically retain 
records about such communications, including records of contacts between the user and 
the provider’s support services, as well records of any actions taken by the provider or 
user as a result of the communications. 

26. In my training and experience, evidence of who was using an online account 
may be found in address books, contact or buddy lists, emails in the account, and pictures 
and files, whether stored as attachments or in the suite of the service provider’s online 
applications. Therefore, the computers of the Service Providers are likely to contain 
stored electronic communications (including retrieved and un-retrieved email for their 
subscribers) and information concerning subscribers and their use of the provider’s 
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services, such as account access information, email transaction information, documents, 
pictures, and account application information. 

27. Microsoft maintains and offers its users the use of OneDrive. OneDrive is 
a file-hosting service operated by Microsoft as part of its suite of o nlin e services. It allows 
users to store files as well as other personal data like Windows settings or BitLocker 
recovery keys in the cloud. Files can be synced to a PC and accessed from a web browser 
or a mobile device, as well as shared publicly or with specific people. OneDrive offers 5 
gigabytes of storage space free of charge; additional storage can be added either 
separately or through subscriptions to other Microsoft services including Office 365 and 
Groove Music. 

28. Microsoft offers additional services that may be accessed in relation to and 
share associated information with a user’s email account, including: Office 365, Windows 
Live Mail, Windows Live Writer, Windows Photo Gallery, Windows Live Messenger, 
Microsoft Family Safety, and Microsoft Outlook Hotmail Connector. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

29. Your Affiant anticipates executing these warrants under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Microsoft to disclose to the government 
copies of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “B.” Upon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items described in Section II of Attachment “B.” 
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CONCLUSION 


30. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated ” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 

REQUEST FOR SEALING 

31. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 


the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
cause to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 


Respectfully Submitted, 


Zachary C. McKinney, Special Agent 
Federal Bureau of Investigation 


SWORN TO ANI^gUBSCRIBED 
before me this L5. day of October 2017. 


_ NANCY J. KOPPE _ 

UNITED STATES MAGISTRATE JUDGE 


[ hereby attest and certify on. \ohi/m 
that the foregoing document is a full tote and correct 
copy of the original on file in my office, and in my leqal 
custody. 

NANCY J. KOPPE 
U.S. MAGISTRATE JUDGE 
. _ / DISTRICT OF NEVADA 
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ATTACHMENT “A-l” 

ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
centralparkl@live.com (the ‘Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “A-2” 


ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
m 9 nlouroses@live.com (the “Target Account 2”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Kedmond, Washington, 98052. 
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ATTACHMENT “B” 



To the extent that the information described in Attachments A1 and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-l and A-2 from account inception to present: 

a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2. 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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After reviewing all information described in Section I, the United States will seize 


evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transporfc/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses”) that occur in the form of the following, from account inception to present: 


a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co- 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to" the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and ail methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy w'ill be held and preserved 
for the same purposes identified above in Paragraph 2. 


24 


22 










1 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

£ scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A1 and A2; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in' 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution ; 

of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 


b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time wit hin 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AFFIDAVIT IN SUPPORT OF AN 


APPLICATION FOR SEARCH WARRANTS 

I, Zachary C. Mckinney, Special Agent, Federal Bureau of Investigation (FBI), 
having been duly sworn, hereby depose and say: 

INTRODUCTION AND AGENT BACKGROUND 

1* Your Affiant makes this affidavit in support of an application for search 
warrants for information associated with email accounts centralnark l@live.com (“Target 

8 Account 1”) and marilouroses@live.com (“Target Account 2”). Target Account 1 is an 

9 account associated with STEPHEN PADDOCK. Target Account 2 is an account 

10 associated with MARILOU DANLEY. The information associated with both accounts is 

11 stored at a premises owned, maintained, controlled, or operated by Microsoft 
Corporation (‘Microsoft), an American multinational technology company based in 

13 Redmond, Washington that specializes in Internet-related services and products along 

14 J with the development and manufacturing of computer-related items. Those online 

15 services include, but are not limited to, email services, cloud computing, and many other 

16 services. The information to be searched is described in the following paragraphs and in 
Attachment “A” (attached hereto and incorporated herein by reference). This affidavit is 

IS made in support of an application for search warrants under 18 U.S.C. §§ 2703(a), 
19 2703(b)(1)(A), and 2703(c)(1)(A) to require Microsoft to disclose to the government 

29 records and other information in its possession, pertaining to the subscriber or customer 
21 associated with the Target Accounts. 

2. I am a Special Agent with the Federal Bureau of Investigation, currently 
23 assigned to Las Vegas, Nevada. I have been employed as a Special Agent of the FBI since 
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March of 2017. Over the course of my employment with the FBI, I have conducted 
surveillance, analyzed telephone records, interviewed witnesses, supervised activities of 
sources, executed search warrants, and executed arrest warrants. These investigative 
activities have been conducted in conjunction with a variety of investigations, to include 
those involving robbery, drug trafficking, human trafficking, criminal enterprises, and 
more. In addition to my practical experiences, I received five months of extensive law 
enforcement training at the FBI Academy, Previous to the FBI, I was employed as a 
human intelligence gatherer with the United States Army. I was trained extensively in 
interrogation, interview, and source handling techniques and best practices. I also 
received an MBA in International Business and worked with ExxonMobil as a financial 
manager. 

3. I make this affidavit in support of an application for a search warrant for 
information associated with the Microsoft accounts associated with 
centralparkl@live.com” and “marilouroses@live.com,” which is stored at a premises 
owned, maintained, controlled, or operated by Microsoft Corporation, headquartered at 
One Microsoft Way, Redmond, WA 98052*6399, hereinafter referred to as “premises,” 
and further described in Attachments A-l and A-2 hereto. 

a. Destruction/Damage of Aircraft or Aircraft Facilities -18 U.S.C A. § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee — 18 U.S.C. §§ 922(a)(3) and (5); 

d. Aiding and Abetting — 18 U.S.C. § 2. 
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(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK, 
MARILOU DANLEY, and others yet unknown. There is also probable cause to search 
the information described in Attachment “A” for evidence of these crimes and 
information which might reveal the identities of others involved in these crimes, as 
described in Attachment “B” (attached hereto and incorporated herein by reference). 

PROBABLE CAUSE 

4. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

5. LVMPD officers ultimately made entry into the room and located an 
individual later identified as Stephen Paddock. Paddock was deceased from an apparent 
self-inflicted gunshot wound. 

6. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 

4 












located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 

7. On October 2,2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms, Paddock’s vehicle at Mandalay Bay, and two Nevada residences owed 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammunition and 100 
pounds of explosive material was found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of ammunition was located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

8. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

9. In an effort to determine whether or not STEPHEN PADDOCK was 
assisted and/or conspired with unknown individuals, investigators have attempted to 
identify all of STEPHEN PADDOCK’S associated. It was quickly determined that a 
casino player’s card in the name of MARILOU DANLEY was located in the room at the 
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time of the attack. She has been identified thus far as the most likely person who aided 
or abetted STEPHEN PADDOCK based on her informing law enforcement that her 
fingerprints would likely be found on the ammunition used during the attack. 
Subsequently, investigators worked to identify the communication facilities utilized by 
STEPHEN PADDOCK and MARILOU DANLEY. 

10. Based on a review of STEPHEN PADDOCK's financial accounts, Target 
Account 1 was determined to belong to STEPHEN PADDOCK On October 3, 2017, 
investigators requested an emergency disclosure of records from Microsoft related to 
Target Account 1 so it could be immediately searched for any evidence of additional co¬ 
conspirators. Unfortunately, the information was only requested for a six-month 
timeframe. Within the account, investigators identified Target Account 2 as one that 
belonged to MARILOU DANLEY, which was clear based on the communications 
between the two email accounts. In an interview, DANLEY stated that PADDOCK had 
access to one of her email accounts, which investigators believe to be Target Account 2. 

11. On September 25, 2017, an email was exchanged between the Target 
Accounts which discussed a wire transfer of funds which was to be sent by STEPHEN 
PADDOCK to MARILOU DANLEY. It is unclear what the purpose of the wire transfer 
was, but MARILOU DANLEY is known to have been in the P hili ppines at the time. 

12. Additionally, on July 6, 2017, Target Account 1 sent an email to 
centralpark48Q4@Ermail.com which read, “try an ar before u buy. we have huge selection, 
located in the las vegas area ” Later that day, an email was received back from 
centralpark4804@gmail.com to Target Account 1 that read, “we have a wide variety of 
optics and ammunition to try." And lastly, Target Account 1 later sent an email to 
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centralpark4804@gmail-com that read, “for a thrill try out bumpfire ar’s with a 100 
round magazine.” Investigators believe these communications may have been related to 
the eventual attack that occurred at the Mandalay Bay in Las Vegas. 

13. Your Affiant believes the requested search warrants will yield sig nifi cant 
information from Microsoft such as STEPHEN PADDOCK's and MARILOU DANLEYs 
contact lists, email messages content, IP address usage, photographs, third-party 
applications associated with the account, and more, which may constitute evidence of 
the planning of the attack and potentially identify other participants in the attack. 
Ultimately, your Affiant strongly believes the requested information will lead 
investigators to determine the full scope of STEPHEN PADDOCK’s plan and MARILOU 
DANLEYs possible involvement. 

14. Investigators have previously sought and obtained a search warrant to 
examine the contents of both Target Accounts 1 and 2. After execution of that warrant, 
however, it became apparent and was confirmed with Microsoft that Microsoft was 
refusing to provide data related to/contained in the OneDrive o nlin e storage files for 
either account. Microsoft indicated to investigators that it did not believe such 
information was encompassed by the items to be produced that were specified in the 
original warrant. Investigators believe therefore that there is additional evidence 
Microsoft currently possesses that relates to the OneDrive online storage service, as well 
as potentially in a suite of other online services that Microsoft offers, including Office 
365, Windows Live Mail, Windows Live Writer, Windows Photo Gallery, Windows Live 
Messenger, Microsoft Family Safety, and Microsoft Outlook Hotmail Connector. Thus, 
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your Affiant seeks more specific authorization to seize and search the OneDrive and 
other service data specified in Attachment B of the instant warrant application. 

RELEVANT TECHNICAL TERMS 

15. The following non-exhaustive list of definitions applies to this Affidavit and 

the Attachments to this Affidavit: 

a. The “Internet” is a worldwide network of computer systems operated 
fay governmental entities, corporations, and universities. In order to access the Internet, 
an individual computer user must subscribe to an access provider, which operates a host 
computer system with direct access to the Internet. The World Wide Web is a 
functionality of the Internet which allows users of the Internet to share information. 

b. “Internet Service Providers” are companies that provide access to the 
Internet. ISPs can also provide other services for their customers including website 
hosting, email service, remote storage, and co-location of computers and other 
communications equipment. ISPs offer different ways to access the Internet including 
telephone-based (dial-up), broadband-based access via a digital subscriber line (DSL) or 
cable television, dedicated circuits, or satellite-based subscription. ISPs typically charge 
a fee based upon the type of connection and volume of data (bandwidth). Many ISPs 
assign each subscriber an account name, such as a user name, an email address, and an 
email mailbox, and the subscriber typically creates a password for his/her account. 

c. “ISP Records” are records maintained by ISPs pertaining to their 
subscribers (regardless of whether those subscribers are individuals or entities). These 
records may include account application information, subscriber and billing information, 
account access information (often in the form of log files), emails, information concerning 
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content uploaded and/or stored on the ISP’s servers, and other information, which may 
be stored both in computer data format and in written or planted record format. ISPs 
reserve and/or maintain computer disk storage space on their computer system for their 
subscribers’ use. This service by ISPs allows for both temporary and long-term storage 
of electronic communications and many other types of electronic data and files. 

d. “Online service providers” (also referred to here as “service 
providers”) are companies that provide online services such as email, chat or instant 
messaging, word processing applications, spreadsheet applications, presentation 
applications similar to PowerPoint, online calendar, photo storage and remote storage 
services. Sometimes they also can provide web hosting, remote storage, and co-location 
of computers and other communications equipment. Typically, each service provider 
assigns each subscriber an account name, such as a user name or screen name and the 

. subscriber typically creates a password for his/her account. 

e. “Computer,” as used herein, is defined as “an electronic, magnetic, 
optical, electrochemical, or other high speed data processing device performing logical or 
storage functions, and includes any data storage facility or communications facility 
directly related to or operating in conjunction with such device.” 

f. A “server” is a centralized computer that provides services for other 
computers connected to it via a network. The other computers attached to a server are 
sometimes called “clients.” For example, in a large company, it is common for individual 
employees to have client computers at their desktops. When the employees access their 
email, or access files stored on the network itself, those files are pulled electronically 
from the server, where they are stored, and are sent to the client’s computer via the 
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network. Notably, servers can be physically stored in any location: it is not uncommon 
for a network’s server to be located hundreds (and even thousands) of miles away from 
the client computers. 

g. Internet Protocol address,” or “IP address,” refers to a unique 
number used by a computer to access the Internet. IP addresses can be dynamic, 
meaning that the Internet Service Provider (ISP) assigns a different unique number to 
a computer every time it accesses the Internet. IP addresses might also be static, that 
is, an ISP assigns a user’s computer a particular IP address which is used each time the 
computer accesses the Internet. 

h. The term domain” refers to a word used as a name for computers, 
networks, services, etc. A domain name typically represents a website, a server computer 
that hosts that website, or even some computer (or other digital device) connected to the 
internet. Essentially, when a website (or a server computer that hosts that website) is 
connected to the internet, it is assigned an IP address. Because IP addresses are diffi cult 
for people to remember, domain names are instead used because they are easier to 
remember than IP addresses. Domain names are formed by the rules and procedures of 
the Domain Name System (DNS). A common top level domain under these rules is “.com” 
for commercial organizations, “.gov” for the United States government, and “.org” for 
organizations. For example, www.usdoi.gov is the domain name that identifies a server 
used by the U.S. Department of Justice, and which uses IP address of 149.101.46.71. 

i. “Web hosting services” maintain server computers connected to the 
Internet. Their customers use those computers to operate websites on the Internet. 
Customers of web hosting companies place files, software code, databases, and other data 
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on servers. To do this, customers typically connect from their own computers to the 
server computers across the Internet. 

j. The term “Whols” lookup refers to a search of a publicly available 
online database that lists information provided when a domain is registered or when an 
IP address is assigned. 

k. The terms “communications,” “records,” “documents,” “programs,” or 
“materials” include all information recorded in any form, visual or aural, and by any 
means, whether in handmade form (including, but not limited to, writings, drawings, 
paintings), photographic form (including, but not limited to, pictures or videos), or 
electrical, electronic or magnetic form, as well as digital data files. These terms also 
include any applications (i.e. software programs). These terms expressly include, among 
other things, emails, instant messages, chat logs, correspondence attached as to emails 
(or drafts), calendar entries, buddy lists. 

l. “Chat” is usually a real time electronic communication between two 
or more individuals. Unlike email, which is frequently sent, then read and responded to 
minutes, hours, or even days later, chats frequently involve an immediate conversation 
between individuals, similar to a face-to-face conversation. Nearly all chat programs are 
capable of saving the chat transcript, to enable users to preserve a record of the 
conversation. By default, some chat programs have this capability enabled, while others 
do not. Many popular web-based email providers, like Microsoft and Microsoft, provide 
chat functionality as part of the online services they provide to account holders. 

Ill 
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FACTS ABOUT EMAIL PROVIDERS 

16. In my training, my experience and this investigation, I have learned that 
Microsoft (the Service Provider) is a company that provides free web-based Internet 
email access to the general public, and that stored electronic communications, including 
opened and unopened email for Microsoft subscribers may be located on the computers 
of Microsoft. I have also learned that Microsoft Inc. provides various on-line service 
messaging services to the general public. Instant Messaging (“IM”) is a form of real-time 
direct text-based communication between two or more people using shared clients. The 
text is conveyed via devices connected over a network such as the Internet. In addition 
to text, Microsoft’s software allows users with the most current updated versions to 
utilize its webcam service. This option enables users from distances all over the world to 
view others who have installed a webcam on their end. Thus, the Service Provider’s 
servers will contain a wide variety of the subscriber’s files, including emails, address 
books, contact or buddy lists, calendar data, pictures, chat logs, and other files. 

17. To use these services, subscribers register for online accounts like the 
Target Accounts. During the registration process, service providers such as the ones here 
ask subscribers to provide basic personal information. This information can include the 
subscriber’s full name, physical address, telephone numbers and other identifiers, 
alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit card or bank account number). Based on my training and my 
experience, I know that subscribers may insert false information to conceal their 
identity; even if this proves to be the case, however, I know that this information often 
provide clues to their identity, location or illicit activities. 


12 










1 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 
23 


18. In general, when a subscriber receives an email, it is typically stored in the 
subscriber’s “mail box” on that service provider’s servers until the subscriber deletes the 
Email. If the subscriber does not delete the message, the message (and any attachments) 
can remain on that service provider’s servers indefinitely. 

19. . Similarly, when the subscriber sends an email, it is initiated at the 
subscriber’s computer, transferred via the Internet to' the service provider’s servers, and 
then transmitted to its end destination. That service provider often saves a copy of the 
email sent. Unless the sender of the email specifically deletes the Email from the 
provider’s server, the email can remain on the system inde fini tely. 

20. A sent or received email typically includes the content of the message, 
source and destination addresses, the date and time at which the email was sent, and 
the size and length of the email. If an email user writes a draft message but does not 
send it, that message may also be saved by that service provider, but may not include all 
of these categories of data. 

21. Just as a computer on a desk can be used to store a wide variety of files, so 
can online accounts, such as the accounts subject to this application. First, subscribers 
can store many types of files as attachments to emails in online accounts. Second, 
because service providers provide the services listed above (e.g. word processing, 
spreadsheets, pictures), subscribers who use these services usually store documents on 
servers maintained and/or owned by service providers. Thus, these online accounts often 
contain documents such as pictures, audio or video recordings, logs, spreadsheets, 
applications and other files. 
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22. Reviewing files stored in online accounts raises many of the same 
difficulties as with reviewing files stored on a local computer. For example, based on my 
training, my experience and this investigation, I know that subscribers of these online 
services can conceal their activities by altering files before they upload them to the online 
service. Subscribers can change file names to more innocuous sounding names (e.g. 
renaming “FraudRecords.doc” to “ChristmasList.doc”), they can change file extensions 
to make one kind of file appear like a different type of file (e.g. changing the spreadsheet 
“StolenCreditProfiles.xls” to “FamilyPhoto.jpg” to appear to be a picture file, where the 
file extension “.xls” denotes an Excel spreadsheet file and “.jpg” a JPEG format image 
file), or they can change the times and dates a file was last accessed or modified by 
changing a computer’s system time/date and then uploading that file to the Online 
Accounts. Thus, to detect any files that the subscriber may have concealed, agents will 
need to review all of the files in the Target Accounts; they will, however, only seize the 
items that the Court authorizes to be seized. Similarly, subscribers can conceal their 
activities by encrypting files. Thus, these files may need to be decrypted to detect 
whether it constitutes an Item to be Seized. 

23. I also believe that people engaged in crimes such as the one described 
herein often use online accounts because they give people engaged in these crimes a way 
to easily communicate with other co-conspirators. Moreover, online accounts are easily 
concealed from law enforcement. Unlike physical documents, electronic documents can 
be stored in a physical place far away, where they are less likely to be discovered. 

24. Service providers typically retain certain transactional information about 
the creation and use of each account on their systems. This information can include the 
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date on which the account was created, the length of service, records of log-in (i.e., 
session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the 
account (such as logging into the account via websites controlled by the Service 
Provider), and other log files that reflect usage of the account- In addition, service 
providers often have records of the Internet Protocol address (“IP address”) used to 
register the account and the IP addresses associated with particular logins to the 
account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to 
access the online account. 

25. In some cases, subscribers will communicate directly with a service 
provider about issues relating to the account, such as technical problems, billing 
inquiries, or complaints from or about other users. Service providers typically retain 
records about such communications, including records of contacts between the user and 
the provider’s support services, as well records of any actions taken by the provider or 
user as a result of the communications. 

26. In my training and experience, evidence of who was using an online account 
may be found in address books, contact or buddy lists, emails in the account, and pictures 
and files, whether stored as attachments or in the suite of the service provider’s online 
applications. Therefore, the computers of the Service Providers are likely to contain 
stored electronic communications (including retrieved and un-retrieved email for their 
subscribers) and information concerning subscribers and their use of the provider’s 
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services, such as account access information, email transaction information, documents, 
pictures, and account application information. 

27. Microsoft maintains and offers its users the use of OneDrive. OneDrive is 
a file-hosting service operated by Microsoft as part of its suite of online services. It allows 
users to store files as well as other personal data like Windows settings or BitLocker 
recovery keys in the cloud. Files can be synced to a PC and accessed from a web browser 
or a mobile device, as well as shared publicly or with specific people. OneDrive offers 5 
gigabytes of storage space free of charge; additional storage can be added either 
separately or through subscriptions to other Microsoft services including Office 365 and 
Groove Music. 

28. Microsoft offers additional services that may be accessed in relation to and 
share associated information with a user’s email account, including: Office 365, Windows 
Live Mail, Windows Live Writer, Windows Photo Gallery, Windows Live Messenger, 
Microsoft Family Safety, and Microsoft Outlook Hotmail Connector. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

29. Your Affiant anticipates executing these warrants under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Microsoft to disclose to the government 
copies of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “B.” Upon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items described in Section II of Attachment “B.” 
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CONCLUSION 

30. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is u a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 


31. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 
the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
cause, to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 


Respectfully Submitted, 


Zachary C. McKinney, Special Agent 
Federal Bureau of Investigation 


SWORN TO AND SUBSCRIBED 
before me this day of October 2017. 


NANCY J. KOPPE 


UNITED STATES MAGISTRATE JUDGE 


cuSi^y.'^ °‘ ,S,na! on fl, e m my officJ'atSfn my?^ a | 


NANCY J. KOPPE 
U ‘S- MAGISTRATE JUDGE 

DISTR/CT OF NEVADA 


—Qeputy 
■fc-Jvterii 
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ATTACHMENT “A-l” 

ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
centr alp ark l@Uve.com (the “Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Was hin gton, 98052. 
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ATTACHMENT “A-2” 

ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
marilouroses@Iive.com (the ‘Target Account 2”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “B” 



To the extent that the information, described in Attachments Al and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(1), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-l and A-2 from account inception to present: 

a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2. 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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Information to be seized by the United States 


After reviewing all information described in Section X, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses”) that occur in the form of the following, from account inception to present: 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy’). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 
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4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive .list, as other search procedures may be used): 

a. exa mi nation of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A1 and A2; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or. the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AO 93 (Rev. 1 I/I 3) Search and Seizure Warrant 


United States District Court antn . 


for the 

District of Nevada 


r 0CTl * HI* 30 

. JUDQr 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) •j 

EMAIL ACCOUNT CENTRALPARK1@LIVE.COM THAT ) 
IS STORED AT A PREMISES CONTROLLED BY ) 

MICROSOFT. A1 ) 


Case No. 2:17-mj-01009-NJK 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of _ Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A1 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
Jescribed above, and that such search will reveal (identify the person or describe the property to be seized): 


SEE ATTACHMENTS B and C 


JYOU ARE COMMANDED to execute this warrant on or before OcMg/ z~i t -aoQ (not to exceed 14 days) 

0 in the daytime 6:00 a.m. to 1 0:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ NANCY .1 KOPPF _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

FJ for_days (not to exceed 30) O until, the facts j ustifying, the later specific date of _. 


Date and time issued: 


,ity and state: 


:30 f.*" 


Las Vegas, Nevada 


NANCY J. KOPPE 

Judge’s signature 

u:;;T£D states magistrate judge 


Printed name and title 
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ATTACHMENT “A-l” 


ONLINE ACCOUNT TO BE SEARCHED 
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This warrant applies to information associated with the Microsoft email account 
central parkl@live.com (the ‘Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “B” 



To the extent that the information described in Attachments Al and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-1 and A-2 from account inception to present: 

a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2. 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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After reviewing all information described in Section I, the United States will seize 


evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses ) that occur in the form of the following, from account inception to present: 


a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co- 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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STEVEN W. MYHRE 

Acting United States Attorney 

District of Nevada 

CRISTINA D. SILVA 

PATRICK BURNS 

Assistant United States Attorneys 

501 Las Vegas Blvd. South, Ste. 1100 

Las Vegas, Nevada 89101 

Telephone: (702) 388-6336 

Fax (702) 388-6698 

iohn.p.burns@usdoi.gov 

Attorney for the United States of America 


UNITED STATES DISTRICT COURT 
DISTRICT OF NEVADA 
-oOo- 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
EMAIL ACCOUNTS 
CENTRALPARK1@LIVE.COM THAT IS 
STORED AT A PREMISES 
CONTROLLED BY MICROSOFT. Al 


Magistrate No. } 7. _ ■ ^ ^ ^ 

AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR SEARCH 
WARRANTS 

(Under Seal) 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
EMAIL ACCOUNTS 
MARILOUROSES@LIVE.COM THAT IS 
STORED AT A PREMISES 
CONTROLLED BY MICROSOFT. A2 


STATE OF NEVADA ) 

) ss: 

COUNTY OF CLARK ) 


Magistrate No. 

AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR SEARCH 
WARRANTS 

(Under Seal) 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR SEARCH WARRANTS 

I, Ryan S. Burke, Special Agent, Federal Bureau of Investigation (FBI), having 
been duly sworn, hereby depose and say: 

INTRODUCTION AND AGENT BACKGROUND 

1. Your Affiant makes this affidavit in support of an application for search 
warrants for information associated with email accounts centralparkl@live.com (“Target 
Account 1”) and marilouroses@live.com (“Target Account 2”). Target Account 1 is an 
account associated with STEPHEN PADDOCK. Target Account 2 is an account 
associated with MARILOU DANLEY. The information associated with both accounts is 
stored at a premises owned, maintained, controlled, or operated by Microsoft 
Corporation (“Microsoft”), an American multinational technology company based in 
Redmond, Washington that specializes in Internet-related services and products along 
with the development and manufacturing of computer-related items. Those online 
services include, but are not limited to, email services, cloud computing, and many other 
services. The information to be searched is described in the following paragraphs and in 
Attachment “A” (attached hereto and incorporated herein by reference). This affidavit is 
made in support of an application for search warrants under 18 U.S.C. §§ 2703(a), 
2703(b)(1)(A), and 2703(c)(1)(A) to require Microsoft to disclose to the government 
records and other information in its possession, pertaining to the subscriber or customer 
associated with the Target Accounts. 

2. I am an “investigative or law enforcement officer of the United States” 
within the meaning of Title 18, United States Code, Section 2510(7), that is, an officer of 
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the United States who is empowered by law to conduct investigations of, and to make 
arrests for, offenses enumerated in Title 18, United States Code, Section 2516. 

3. I have been employed as a Special Agent of the FBI for approximately five 
years, which began at the FBI Academy in October 2012. Upon completion of the 
academy, I was transferred to the Las Vegas Division’s white collar crime squad and 
then the human trafficking squad. Since October 2015,1 have been assigned to the Las 
Vegas Division’s violent crime/gang squad. Additionally, I have been a certified member 
of the FBI’s Cellular Analysis Survey Team since August 2015 due to my expertise in 
the field of historical cell site analysis. 

4. During my tenure with the FBI, I have conducted surveillance, analyzed 
telephone records, interviewed witnesses, supervised activities of sources, executed 
search warrants, executed arrest warrants, and participated in court-authorized 
interceptions of wire and electronic communications. These investigative activities have 
been conducted in conjunction with a variety of investigations, to include those involving 
robbery, drug trafficking, kidnapping, murder, criminal enterprises, and more. In 
addition to my practical experiences, I received five months of extensive law enforcement 
training at the FBI Academy. 

5. The facts in this affidavit are derived from your Affiant’s personal 
observations, his training and experience, and information obtained from other agents, 
detectives, and witnesses. This affidavit is intended to show merely that there is 
sufficient probable cause for the requested warrants and does not set forth all of the 
Affiant’s knowledge about this matter. 
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Based on your Affiant’s training and experience and the facts as set forth 
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in this affidavit, there is probable cause to believe that violations of: 

a. Destruction/Damage of Aircraft or Aircraft Facilities -18 U.S.C.A. § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee - 18 U.S.C. §§ 922(a)(3) and (5); 

d. Aiding and Abetting - 18 U.S.C. § 2. 

(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK, 
MAJRILOU DANLEY, and others yet unknown. There is also probable cause to search 
the information described in Attachment “A” for evidence of these crimes and 
information which might reveal the identities of others involved in these crimes, as 
described in Attachment “B” (attached hereto and incorporated herein by reference). 

PROBABLE CAUSE 

7. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 
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8. LVMPD officers ultimately made entry into the room and located an 
individual later identified as Stephen Paddock. Paddock was deceased from an apparent 
self-inflicted gunshot wound. 

9. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 

10. On October 2,2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms, Paddock’s vehicle at Mandalay Bay, and two Nevada residences owed 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammunition and 100 
pounds of explosive material was found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of ammunition was located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

11. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
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on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

12. In an effort to determine whether or not STEPHEN PADDOCK was 
assisted and/or conspired with unknown individuals, investigators have attempted to 
identify all of STEPHEN PADDOCK’S associated. It was quickly determined that a 
casino player’s card in the name of MAKTLOU DANLEY was located in the room at the 
time of the attack. She has been identified thus far as the most likely person who aided 
or abetted STEPHEN PADDOCK based on her informing law enforcement that her 
fingerprints would likely be found on the ammunition used during the attack. 
Subsequently, investigators worked to identify the communication facilities utilized by 
STEPHEN PADDOCK and MAKILOU DANLEY. 

13. Based on a review of STEPHEN PADDOCK’S financial accounts, Target 
Account 1 was determined to belong to STEPHEN PADDOCK. On October 3, 2017, 
investigators requested an emergency disclosure of records from Microsoft related to 
Target Account 1 so it could be immediately searched for any evidence of additional co¬ 
conspirators. Unfortunately, the information was only requested for a six month 
timeframe. Within the account, investigators identified Target Account 2 as one that 
belonged to MARILOU DANLEY, which was clear based on the communications 
between the two email accounts. 

14. On September 25, 2017, an email was exchanged between the Target 
Accounts which discussed a wire transfer of funds which was to be sent by STEPHEN 
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PADDOCK to MARILOU DANLEY. It is unclear what the purpose of the wire transfer 
was, but MARILOU DANLEY is known to have been in the Philippines at the time. 
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15. Additionally, on July 6, 2017, Target Account 1 sent an email to 
centralpark4804@gmail.com which read, “try an ar before u buy. we have huge selection, 
located in the las vegas area.” Later that day, an email was received back from 
centralpark4804@gmail.com to Target Account 1 that read, “we have a wide variety of 
optics and ammunition to tiy.” And lastly, Target Account 1 later sent an email to 
centralpark4804@gmail.com that read, “for a thrill try out bumpfire ar’s with a 100 
round magazine.” Investigators believe these communications may have been related to 
the eventual attack that occurred at the Mandalay Bay in Las Vegas. 

16. Your Affiant believes the requested search warrants will yield significant 
information from Microsoft such as STEPHEN PADDOCK’S and MARILOU DANLEY’s 
contact lists, email messages content, IP address usage, photographs, third-party 
applications associated with the account, and more, which may constitute evidence of 
the planning of the attack and potentially identify other participants in the attack. 
Ultimately, your Affiant strongly believes the requested information will lead 
investigators to determine the full scope of STEPHEN PADDOCK’s plan and MARILOU 
DANLEY’s possible involvement. 

RELEVANT TECHNICAL TERMS 

17. The following non-exhaustive list of definitions applies to this Affidavit and 
the Attachments to this Affidavit: 

a. The “Internet” is a worldwide network of computer systems operated 

by governmental entities, corporations, and universities. In order to access the Internet, 
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an individual computer user must subscribe to an access provider, which operates a host 
computer system with direct access to the Internet. The World Wide Web is a 
functionality of the Internet which allows users of the Internet to share information. 

b. “Internet Service Providers” are companies that provide access to the 
Internet. ISPs can also provide other services for their customers including website 
hosting, email service, remote storage, and co-location of computers and other 
communications equipment. ISPs offer different ways to access the Internet including 
telephone-based (dial-up), broadband-based access via a digital subscriber line (DSL) or 
cable television, dedicated circuits, or satellite-based subscription. ISPs typically charge 
a fee based upon the type of connection and volume of data (bandwidth). Many ISPs 
assign each subscriber an account name, such as a user name, an email address, and an 
email mailbox, and the subscriber typically creates a password for his/her account. 

c. “ISP Records” are records maintained by ISPs pertaining to their 
subscribers (regardless of whether those subscribers are individuals or entities). These 
records may include account application information, subscriber and billing information, 
account access information (often in the form of log files), emails, information concerning 
content uploaded and/or stored on the ISPs servers, and other information, which may 
be stored both in computer data format and in written or printed record format. ISPs 
reserve and/or maintain computer disk storage space on their computer system for their 
subscribers’ use. This service by ISPs allows for both temporary and long-term storage 
of electronic communications and many other types of electronic data and files. 

d. “Online service providers” (also referred to here as “service 
providers”) are companies that provide online services such as email, chat or instant 
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messaging, word processing applications, spreadsheet applications, presentation 
applications similar to PowerPoint, online calendar, photo storage and remote storage 
services. Sometimes they also can provide web hosting, remote storage, and co-location 
of computers and other communications equipment. Typically, each service provider 
assigns each subscriber an account name, such as a user name or screen name and the 
subscriber typically creates a password for his/her account. 

e. “Computer,” as used herein, is defined as “an electronic, magnetic, 
optical, electrochemical, or other high speed data processing device performing logical or 
storage functions, and includes any data storage facility or communications facility 
directly related to or operating in conjunction with such device.” 

f. A “server” is a centralized computer that provides services for other 
computers connected to it via a network. The other computers attached to a server are 
sometimes called “clients.” For example, in a large company, it is common for individual 
employees to have client computers at their desktops. When the employees access their 
email, or access files stored on the network itself, those files are pulled electronically 
from the server, where they are stored, and are sent to the client’s computer via the 
network. Notably, servers can be physically stored in any location: it is not uncommon 
for a network’s server to be located hundreds (and even thousands) of miles away from 
the client computers. 

g. “Internet Protocol address,” or “IP address,” refers to a unique 
number used by a computer to access the Internet. IP addresses can be dynamic, 
meaning that the Internet Service Provider (ISP) assigns a different unique number to 
a computer every time it accesses the Internet. IP addresses might also be static, that 
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is, an ISP assigns a user’s computer a particular IP address which is used each time the 
computer accesses the Internet. 

h. The term “domain” refers to a word used as a name for computers, 
networks, services, etc. A domain name typically represents a website, a server computer 
that hosts that website, or even some computer (or other digital device) connected to the 
internet. Essentially, when a website (or a server computer that hosts that website) is 
connected to the internet, it is assigned an IP address. Because IP addresses are difficult 
for people to remember, domain names are instead used because they are easier to 
remember than IP addresses. Domain names are formed by the rules and procedures of 
the Domain Name System (DNS). A common top level domain under these rules is “.com” 
for commercial organizations, “.gov” for the United States government, and “.org” for 
organizations. For example, www.usdoi.gov is the domain name that identifies a server 
used by the U.S. Department of Justice, and which uses IP address of 149.101.46.71. 

i. “Web hosting services” maintain server computers connected to the 
Internet. Their customers use those computers to operate websites on the Internet. 
Customers of web hosting companies place files, software code, databases, and other data 
on servers. To do this, customers typically connect from their own computers to the 
server computers across the Internet. 

j. The term “Whols” lookup refers to a search of a publicly available 
online database that lists information provided when a domain is registered or when an 
EP address is assigned. 

k. The terms “communications,” “records,” “documents,” “programs,” or 
“materials” include all information recorded in any form, visual or aural, and by any 
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means, whether in handmade form (including, but not limited to, writings, drawings, 
paintings), photographic form (including, but not limited to, pictures or videos), or 
electrical, electronic or magnetic form, as well as digital data files. These terms also 
include any applications (i.e. software programs). These terms expressly include, among 
other things, emails, instant messages, chat logs, correspondence attached as to emails 
(or drafts), calendar entries, buddy lists. 

1. “Chat” is usually a real time electronic communication between two 
or more individuals. Unlike email, which is frequently sent, then read and responded to 
minutes, hours, or even days later, chats frequently involve an immediate conversation 
between individuals, similar to a face-to-face conversation. Nearly all chat programs are 
capable of saving the chat transcript, to enable users to preserve a record of the 
conversation. By default, some chat programs have this capability enabled, while others 
do not. Many popular web-based email providers, like Microsoft and Microsoft, provide 
chat functionality as part of the online services they provide to account holders. 

FACTS ABOUT EMAIL PROVIDERS 
18. In my training, my experience and this investigation, I have learned that 
Microsoft (the Service Provider) is a company that provides free web-based Internet 
email access to the general public, and that stored electronic communications, including 
opened and unopened email for Microsoft subscribers may be located on the computers 
of Microsoft. I have also learned that Microsoft Inc. provides various on-line service 
messaging services to the general public. Instant Messaging (“IM”) is a form of real-time 
direct text-based communication between two or more people using shared clients. The 
text is conveyed via devices connected over a network such as the Internet. In addition 
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to text, Microsoft s software allows users with the most current updated versions to 
utilize its webcam service. This option enables users from distances all over the world to 
view others who have installed a webcam on their end. Thus, the Service Provider’s 
servers will contain a wide variety of the subscriber’s files, including emails, address 
books, contact or buddy lists, calendar data, pictures, chat logs, and other files. 

19. To use these services, subscribers register for online accounts like the 
Target Accounts. During the registration process, service providers such as the ones here 
ask subscribers to provide basic personal information. This information can include the 
subscriber’s full name, physical address, telephone numbers and other identifiers, 
alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit card or bank account number). Based on my training and my 
experience, I know that subscribers may insert false information to conceal their 
identity; even if this proves to be the case, however, I know that this information often 
provide clues to their identity, location or illicit activities. 

20. In general, when a subscriber receives an email, it is typically stored in the 
subscriber’s “mail box” on that service provider’s servers until the subscriber deletes the 
Email. If the subscriber does not delete the message, the message (and any attachments) 
can remain on that service provider’s servers indefinitely. 

21. Similarly, when the subscriber sends an email, it is initiated at the 
subscriber’s computer, transferred via the Internet to the service provider’s servers, and 
then transmitted to its end destination. That service provider often saves a copy of the 
email sent. Unless the sender of the email specifically deletes the Email from the 
provider’s server, the email can remain on the system indefinitely. 
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22. A sent or received email typically includes the content of the message, 
source and destination addresses, the date and time at which the email was sent, and 
the size and length of the email. If an email user writes a draft message but does not 
send it, that message may also be saved by that service provider, but may not include all 
of these categories of data. 

23. Just as a computer on a desk can be used to store a wide variety of files, so 
can online accounts, such as the accounts subject to this application. First, subscribers 
can store many types of files as attachments to emails in online accounts. Second, 
because service providers provide the services listed above (e.g. word processing, 
spreadsheets, pictures), subscribers who use these services usually store documents on 
servers maintained and/or owned by service providers. Thus, these online accounts often 
contain documents such as pictures, audio or video recordings, logs, spreadsheets, 
applications and other files. 

24. Reviewing files stored in online accounts raises many of the same 
difficulties as with reviewing files stored on a local computer. For example, based on my 
training, my experience and this investigation, I know that subscribers of these online 
services can conceal their activities by altering files before they upload them to the online 
service. Subscribers can change file names to more innocuous sounding names (e.g. 
renaming “FraudRecords.doc” to “ChristmasList.doc”), they can change file extensions 
to make one kind of file appear like a different type of file (e.g. changing the spreadsheet 
“StolenCreditProfiles.xls” to “FamilyPhoto.jpg” to appear to be a picture file, where the 
file extension “.xls” denotes an Excel spreadsheet file and “.jpg* a JPEG format image 
file), or they can change the times and dates a file was last accessed or modified by 

13 




1 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 
23 


changing a computer’s system time/date and then uploading that file to the Online 
Accounts. Thus, to detect any files that the subscriber may have concealed, agents will 
need to review all of the files in the Target Accounts; they will, however, only seize the 
items that the Court authorizes to be seized. Similarly, subscribers can conceal their 
activities by encrypting files. Thus, these files may need to be decrypted to detect 
whether it constitutes an Item to be Seized. 

25. I also believe that people engaged in crimes such as the one described 
herein often use online accounts because they give people engaged in these crimes a way 
to easily communicate with other co-conspirators. Moreover, online accounts are easily 
concealed from law enforcement. Unlike physical documents, electronic documents can 
be stored in a physical place far away, where they are less likely to be discovered. 

26. Service providers typically retain certain transactional information about 
the creation and use of each account on their systems. This information can include the 
date on which the account was created, the length of service, records of log-in (i.e., 
session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the 
account (such as logging into the account via websites controlled by the Service 
Provider), and other log files that reflect usage of the account. In addition, service 
providers often have records of the Internet Protocol address (“IP address”) used to 
register the account and the IP addresses associated with particular logins to the 
account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to 
access the online account. 


24 


14 






27. In some cases, subscribers will communicate directly with a service 
provider about issues relating to the account, such as technical problems, billing 
inquiries, or complaints from or about other users. Service providers typically retain 
records about such communications, including records of contacts between the user and 
the provider’s support services, as well records of any actions taken by the provider or 
user as a result of the communications. 

28. In my training and experience, evidence of who was using an online 
account may be found in address books, contact or buddy lists, emails in the account, 
and pictures and files, whether stored as attachments or in the suite of the service 
provider’s online applications. Therefore, the computers of the Service Providers are 
likely to contain stored electronic communications (including retrieved and un-retrieved 
email for their subscribers) and information concerning subscribers and their use of the 
provider’s services, such as account access information, email transaction information, 


documents, pictures, and account application information. 


INFORMATION TO BE SEARCHED 




GS TO BE SEIZED 


29. Your Affiant anticipates executing these warrants under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Microsoft to disclose to the government 
copies of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “B.” Upon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items described in Section II of Attachment “B.” 

CONCLUSION 
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30. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 

I 

REQUEST FOR SEALING 

31. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 
the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
cause to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 


Respectfully Submitted, 



‘Ryan S. Burke, Special Agent 
Federal Bureau of Investigation 


SWORN TO AND SUBSCRIBED 
before me this /a day of October 2017. 
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ATTACHMENT “Al” 


ONLINE ACCOUNT TO BE SEARCHED 

1. This warrant applies to information associated with the Microsoft email 
account centralparkl@live.com (the ‘Target Accounts”) from their inception to present, 
which is stored at premises owned, maintained, controlled, or operated by Microsoft 
Corporation, headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “A2T 


ONLINE ACCOUNT TO BE SEARCHED 

3 

1. This warrant applies to information associated with the Microsoft email 

4 account marilouroses@live.com (the “Target Accounts”) from their inception to present, 
which is stored at premises owned, maintained, controlled, or operated by Microsoft 

5 Corporation, headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses ) that occur in the form of the following, from account inception to present: 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co- 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 

programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 


ATTACHMENT “C” 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 
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a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A1 and A2; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
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copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 


b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)( 1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 
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e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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1 hereby attest and certify on. 


United States District 


In the Matter of the Search of 

(Briefly describe the property lo be searched 
or identify the person by name and address) 

Mariloudanleyy A3 


for the 

District of Nevada 


custody. 




CAM FERENBACH 
U S. MAGISTRATE JUDGE 
DISTRICT OF NEVADA 


Case No. 2:17-mj-00960-VCF 


-j. Deputy 
_£L Secretary 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the ____ District of _ Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A3 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS B and C 


YOU ARE COMMANDED to execute this warrant on or before _ (not lo exceed 14 days) 

. &-in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ CAM FFRI-NBA.CH _. 

(United States Magistrate Judge) 

O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed30) □ until, the facts justifying, the later specific date of _. 


Date and time issued: 




Citv and state: Las Vegas, Nevada 


CAM FERENBACH 
CAM 

U.S. MAGISTRATE JUDGE 


Printed name and title 
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Attachment “A3” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs mariloudanleyy, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 
headquartered in Menlo Park, California for the time period beginning September 1,2016 to present. 
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Particular Things to be Seized 
I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Instagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved pursuant 
to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1, 2016 to present: 

(a) All contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, Instagram 
passwords, Instagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other Instagram activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending “Friend” requests; 
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All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

All IP logs, including all records of the IP addresses that logged into the account; 

All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

All location data associated with the account, including geotags; 

All data and information that has been deleted by the user; 

All past and present lists of friends created by the account; 

All records of Instagram searches performed by the account; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and instrumentalities 
of violations of: 

Violation of National Firearms Act - Registration of Firearms, Title 26, United States Code, 
Section 5841. 

involving STEPHEN PADDOCK and others yet unidentified, including, for each user ID identified 
on Attachment “A,” information pertaining to the following matters: 

(a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 
accessories, ammunition, or explosives by Paddock, including through conspiring and 
cooperating to possess, use, purchase, or sell prohibited firearms, firearms 
accessories, ammunition, or explosives. 

(b) Evidence indicating how and when the Instagram account was accessed or used, to 
determine the chronological and geographic context of account access, use, and 
events relating to the crime under investigation and to the Facebook account owner; 

(c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 
crime under investigation; 

(d) The identity of the person(s) who created or used the user ID, including records that 
help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ED about matters 
relating to the illegal possession, purchase, use, or sale of firearms, firearms 
accessories, ammunition, or explosives, including records that help reveal their 
whereabouts. 

The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
separately sealed, as though set forth fully herein. 
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ATTACHMENT C 


2 | PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 

3 PURSUANT TO THIS SEARCH WARRANT 
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1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy”). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section II. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 
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a. examination of ail of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 
d opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found Hash values are under- 

inclusive, but are still a helpful tool; 
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f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 
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6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 
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(e) Issuing the Warrant 
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(2) Contents of the Warrant. 
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(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant The time for executing the warrant in Rule 41 (e)(2)(A) and 
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(f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 

b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court may be 
limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41 (f)( 1 )(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government 

e. If the person from whom any Search Warrant Data was seized requests the return of any 
information in the Search Warrant Data that is not set forth in Attachment B, Section D, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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AO !06 (Rev. 0^/10) Application for a Search Warrant 


United States District Court - 


for the 

District of Nevada 




thS^e S f^g^n^dacument is a full true and correct 
copy of the original on file in my office, and in my legal 
custody. 


In the Matter of the Search of 

(Briefly describe she property to be searched 
or identify the person by name and address) 

INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY FACEBOOK 
CORPORATION: Mariloudanleypaddock A 4 


) 

) 

) 

) 

) 

) 


2ase No. 

’ By. 


CAM FERENBACH 
US. MAGISTRATE JUDGE 
2:17-mj-0096 DiyRBPT OF NEVADA 

-— Deputy 

--^Secretary 




APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of peijury that I have reason to believe that on the following person or property (identify the person or describe the 

AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: 

Mariloudanleypaddock A4 

located in the _ PEA _ District of ___ > there is now concealed (identify the 

person or describe the property to be seized)'. 

INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: 
Mariloudanleypaddock A4 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

^ evidence of a crime; 

fif contraband, fruits of crime, or other items illegally possessed; 

property designed for use, intended for use, or used in committing a crime; 
ST a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

Title 26, United States Code, Violation of National Firearms Act 
Section 5841. 
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The application is based on these facts: t t « A o- 

I believe there is probable cause to believe that in the subject accounts listed in Attachments Ai , A i, aj , 

*A4", "A5“ there is proof that constitutes evidence of the commission of criminal offense(s); contraband, the fruits 
of crime and things otherwise criminally possessed and been used as the means of committing criminal offense(s) 


□ Continued on the attached sheet 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


_!/ _ 

Applicant's signature 


Sworn to before me and signed in my presence. 


Date: 


City and state: 


k> 'f-n 

Las Vegas, Nevada 


Printed name and title 


CAM FERENBACH 


JvdftelzsigMk 
CAM 


u.g.magistrM£^ dG£ 

Printed name and title 
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1 hereby attest and certify on ' /0 3 —~/ v ) 

United States District 

for the custo * 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

Mariloudanleypaddock A4 


District of Nevada 


) 

) 

) Case No. 

) 

) 

) 


By- 


CAM FERENBACH 
U.S. MAGISTRATE JUDGE 
yA DISTRICT OF NEVADA 

— _ . D eputy 

ygTSecreiary 


2‘J t-mj-00961 -VCF 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the __ District of _ Nevada 

(identify the person or describe the property to be searched and give its location)'. 

SEE ATTACHMENT A4 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

SEE ATTACHMENTS B and C 


YOU ARE COMMANDED to execute this warrant on or before /O ^ io exceed 14 days) 

g3Lin the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ ccoFMP.AHH _. 

V “ ,r ftfnited States Magistrate Judge) ~ 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

CJ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of __ • 

/O -3-/7 CAM FERHNfcACH _ 

^ “ wStitiamSK 

Las Vegas, Nevada U.S. MAGISTRATE JUDGE 


Date and time issued: 
City and state: 


Printed name and title 
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Attachment “A4” 


Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs 
mariloudanleypaddock, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
September 1,2016 to present. 
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ATTACHMENT “B” 

Particular Things to be Seized 
I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Lnstagram LLC (“lnstagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to lnstagram, or have been preserved pursuant 
to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1, 2016 to present: 

(a) All contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, lnstagram 
passwords, lnstagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other lnstagram activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ lnstagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending “Friend” requests; 
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All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

All IP logs, including all records of the JOP addresses that logged into the account; 

All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

All location data associated with the account, including geotags; 

All data and information that has been deleted by the user. 

All past and present lists of friends created by the account; 

All records of Instagram searches performed by the account; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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33. Information to be seized by the government 

2 | All infonnation described above in Section I that constitutes fruits, evidence, and instrumentalities 

3 I of violations of: 


Violation of National Firearms Act - Registration of Firearms, Title 26, United States Code, 
Section 5841. 

involving STEPHEN PADDOCK and others yet unidentified, including, for each user ID identified 
on Attachment “A,” information pertaining to the following matters: 

(a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 
accessories, ammunition, or explosives by Paddock, including through conspiring and 
cooperating to possess, use, purchase, or sell prohibited firearms, firearms 
accessories, ammunition, or explosives. 

(b) Evidence indicating how and when the Instagram account was accessed or used, to 
determine the chronological and geographic context of account access, use, and 
events relating to the crime under investigation and to the Facebook account owner; 

(c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 
crime under investigation; 

(d) The identity of the person(s) who created or used the user ID, including records that 
help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ID about matters 
relating to the illegal possession, purchase, use, or sale of firearms, firearms 
accessories, ammunition, or explosives, including records that help reveal their 
whereabouts. 


The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
separately sealed, as though set forth fully herein. 
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ATTACHMENT C 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 


1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (‘the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data ("the Search Warrant Data Copy”). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section H The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 


19 








1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 


a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 


6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 
(e) Issuing the Warrant. 
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(2) Contents of the Warrant. 
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(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant The time for executing the warrant in Rule 41(e)(2)(A) and 
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(f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant. 

(I) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 
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b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court may be 
limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 
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e. If the person from whom any Search Warrant Data was seized requests the return of any 

information in the Search Warrant Data that is not set forth in Attachment B, Section n, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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3-/7 


United States District 


l herefayattest and cef%on~ 


for the 

District of Nevada 


custody. 


egping document is a full true and correct 
-txigjnal bn file in my office, and in my legal 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identity the person by name and address) 

INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY FACEBOOK 
CORPORATION: marilou.danley A5 


By- 



Case No. 


2:17-mj-00962-V CF 


CAM FERENBACH 
U S. MAGISTRATE JUDGE 
DISTRICT OF NEVADA 


—yDeputy 
—^Secretary 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property ( identify the person or describe the 

AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: marilou.danley 
A5 


located in the _ PEA _District of_, there is now concealed (identify the 

person or describe the property to be seized)'. 

INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: marilou.danley 
A5 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

^ evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

Sl( property designed for use, intended for use, or used in committing a crime; 
sf a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

Title 26, United States Code, Violation of National Firearms Act 
Section 5641. 


The application is based on these facts: . , , ... ' . , 1M . .... 

I believe there is probable cause to believe that in the subject accounts listed in Attachments A1 , A2 , A3 , 

*A4", “A5" there is proof that constitutes evidence of the commission of criminal offense(s); contraband, the fruits 
of crime and things otherwise criminally possessed and been used as the means of committing criminal offense(s) 


□ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 



Sworn to before me and signed in my presence. 


Date: 




City and state 


Las Vegas, Nevada 


CAM FERENBACH 


U.S. MAGISTRATE JUDGE 


Printed name and title 
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United 


In the Matter of the Search of 

(Briefly describe the properly to be searched 
or identify (he person by name and address) 

marilou.danley A5 




I hereby attest and certify on /jL ZdL 

States District docurneni ‘ s 3 ^ true ^ nd c ° rrec * 

for the CUSt0dy ' 


original on file in my office, and in my legal 


CAM FERENBACH 

District of Nevada u.s magistrate JUDGE 

DISTRICT OF NEVADA 


) Case No. 

) 

) 

) 


962-VCF 


_Deonty 

_^pec.ei3ry 



SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ .... District of - Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A5 


1 find that the affidavit^), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS B and C 


Ar7*-0_ _ (not to exceed l A days) 


YOU ARE COMMANDED to execute this warrant on or before _ 

in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to e 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution oHhew^pt^ must prepare an inventory 
is required by law and promptly return this warrant and inventory to_C--. 1 - - ’ » —----- 

‘ /I InitaA tufncrislrntp .tudfp) 


□ Pursuant to 18 U.S.C. § 3103a(b), 1 find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

a for_days (not to exceed30) O until, the facts justifying, the later specific date of---- 


Date and time issued: 


/t> "X—if hrbS r 


City and state: las Vegas, Nevada 


CAM FERENBACH 

Judge's signature 

CAM FERENBACH 
US. MAGIS TRATE JUDGE 

Printed name and title 






Attachment “A5” 


Property to Be Searched 


This warrant applies to information associated with the Instagram user IDs and 
marilou.danley that is stored at premises owned, maintained, controlled, or operated by Facebook, a 
company headquartered in Menlo Park, California for the time period beginning September 1, 2016 
to present. 
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by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending ‘Triend” requests; 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and instrumentalities 
of violations of: 

Violation of National Firearms Act - Registration of Firearms, Title 26, United States Code, 
Section 5841. 

involving STEPHEN PADDOCK and others yet unidentified, including, for each user ID identified 
on Attachment “A,” information pertaining to the following matters: 

(a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 
accessories, ammunition, or explosives by Paddock, including through conspiring and 
cooperating to possess, use, purchase, or sell prohibited firearms, firearms 
accessories, ammunition, or explosives. 

(b) Evidence indicating how and when the Instagram account was accessed or used, to 
determine the chronological and geographic context of account access, use, and 
events relating to the crime under investigation and to the Facebook account owner; 

(c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 
crime under investigation; 

(d) The identity of the person(s) who created or used the user ID, including records that 
help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ID about matters 
relating to the illegal possession, purchase, use, or sale of firearms, firearms 
accessories, ammunition, or explosives, including records that help reveal their 
whereabouts. 

The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
separately sealed, as though set forth fully herein. 


18 






All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

All IP logs, including all records of the IP addresses that logged into the account; 

All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

All location data associated with the account, including geotags; 

All data and information that has been deleted by the user. 

All past and present lists of friends created by the account; 

All records of Instagram searches performed by the account; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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ATTACHMENT C 



PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 


4 

5 
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i. In executing this warrant, the government must make reasonable efforts to use 

methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 
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2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy 5 ’). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section II. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 
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4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 
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a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the c rimin al activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identity the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant. The time for executing the warrant in Rule 41(e)(2)(A) and 


20 













1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


(f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the wanunt and copied 
after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41 (f)( 1 )(B), the inventory return that is to be filed with the court may be 
limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41 (f)( 1 )(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return of any 
information in the Search Warrant Data that is not set forth in Attachment B, Section II, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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United States District Court 

for the 

District of Nevada 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

CENTRALPARK1@LIVE.COM- A1 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of _N evada 

(identify the person or describe the property to be searched and give its location)’. 

SEE ATTACHMENT A1 


Case No. 2:l7-mj- 


1 Find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS B and C 


y6v ARE COMMANDED to execute this warrant on or before 


0 


X_C~sfe ( ( n °t 1° exceed 14 days) 


3 in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because gooa cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the'execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to _ 

'\\Mnited States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b). 1 find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_ days (not to exceed 30) □ until, the facts justifying, the later specific date of __ 


Date and time issued: 

City and state: Las Vegas, Nevada _ 
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ATTACHMENT “B” 
Particular Things to be Seized 


I. Information to be disclosed by the Service Provider 
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To the extent that the information described in Attachment A1 and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, 
logs, or information that have been deleted but are still available to Service Provider, 
or have been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service 
Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A1 and A2 from account inception to present: 
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a. The contents of all emails associated with the account, including copies of 
emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at 
which each email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other 
identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means 
and source of payment (including any credit or bank account number); 

c. All records or other information stored in the Online Accounts, including 
address books, contact and buddy lists, calendar data, pictures, 
applications, documents, and other files; 

d. All records pertaining to communications between Service Provider and 
any person regarding the account, including contacts with support services 
and records of actions taken. 

e. All third-party application data and content associated with the Target 
Account through any Android operating system and/or any Microsoft- 
related facility. 
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II. Information to be seized bv the United States 
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After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destmction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses”) that occur in the form of the following, from account inception to present: 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 
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1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data fisted as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive fist, as other search procedures may be used): 
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a. examination of all of the data contained in the Search Warrant Data to view 


the data and determine whether that data falls within the items to be seized as set forth 

2 

herein; 

3 

b. searching for and attempting to recover from the Search Warrant Data any- 


deleted, hidden, or encrypted data to determine whether that data falls within the list 

4 

of items to be seized as set forth herein (any data that is encrypted and unreadable will 

5 

not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 

6 

(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

7 

c. surveying various file directories and the individual files they contain; 

8 

d. opening files in order to determine their contents; 

Q 

e. using hash values to narrow the scope of what may be found. Hash values 

y 

are under- inclusive, but are still a helpful tool; 

10 

f. scanning storage areas; 

11 

g. performing keyword searches through all electronic storage areas to 

12 

determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A1 and A2; and/or 

13 

h. performing any other data analysis technique that may be necessary to 

14 

locate and retrieve the evidence described in Attachment B, Section II. 

15 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

16 

part: 

17 

(e) Issuing the Warrant. 

18 

(2) Contents of the Warrant. 

19 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 


device warrant, the warrant must identify the person or property to be searched, identify 

20 

any person or property to be seized, and designate the magistrate judge to whom it must 

21 

be returned. The warrant must command the officer to: 

22 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 

23 

: 24 
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\ 

41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
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copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the ‘later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 
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e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AO 93 (Rev 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Nevada 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case No 2'17-mj- 

EMAIL ACCOUNT CENTRALPARK4804@GMAIL.COM ) 

) 

SEARCH AND SEIZURE WARRANT 


976- AJd/< 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the ___ District of _ Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS 8 and C 


^0U ARE COMMANDED to execute this warrant on or before f^)r friy/ jrySffi o/ to exceed 14 days) 

3 1 in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during thd execution of the warrant must prepare an inventory 

as required by law and promptly return this warrant and inventory to ^0>fOcx-A _ 

Waited States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), 1 find that immediate notification may have gm adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of_ 


Date and time issued: 

City and state: 




¥ 





tge s signature 


Las Vegas, Nevada 


\ \ * f Printed name and tine \ 
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ATTACHMENT “A” 
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ONLINE ACCOUNT TO BE SEARCHED 

1. This warrant applies to information associated with the Google email 
account centralpark4804@gmail.com (the “Target Account”) from its inception to 
present, which is stored at premises owned, maintained, controlled, or operated by 
Google, Inc., headquartered at 1600 Amphitheatre Way, Mountain View, California, 
94043. 
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ATTACHMENT “B” 
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To the extent that the information described in Attachment A is within the 
possession, custody, or control of Google, including any Emails, records, files, logs, or 
information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 

a. The contents of all emails associated with the account, including copies of 
emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at 
which each email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other 
identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means 
and source of payment (including any credit or bank account number); 

c. All records or other information stored in the Online Accounts, including 
address books, contact and buddy lists, calendar data, pictures, 
applications, documents, and other files; 

d. All records pertaining to communications between Service Provider and 
any person regarding the account, including contacts with support services 
and records of actions taken. 

e. All third-party application data and content associated with the Target 
Account through any Android operating system and/or any Google-related 
facility. 
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After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present: 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 


24 


19 




1 


ATTACHMENT “C” 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 
23 


PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing- this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessaiy to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

4 e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 

5 Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702)388-6336 





STEVEN W. MYHRE 

Acting United States Attorney 

District of Nevada 

CRISTINA D. SELVA 

PATRICK BURNS 

Assistant United States Attorneys 

501 Las Vegas Blvd. South, Ste. 1100 

Las Vegas, Nevada 89101 

Telephone: (702) 388-6336 

Fax (702) 388-6698 

iohn.p.bums@usdoi.gov 

Attorney for the United States of America 


UNITED STATES DISTRICT COURT 
DISTRICT OF NEVADA 
-oOo- 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
EMAIL ACCOUNT 
CENTRALPARK48Q4@GMAIL.COM 
THAT IS STORED AT A PREMISES 
CONTROLLED BY GOOGLE. 


STATE OF NEVADA ) 

) 

COUNTY OF CLARK ) 


Magistrate No. Yl- - CjjQ - 

AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH 
WARRANT 


(Under Seal) 


AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 

I, Ryan S. Burke, Special Agent, Federal Bureau of Investigation (FBI), having 

been duly sworn, hereby depose and say: 

INTRODUCTION AND AGENT BACKGROUND 


1. Your Affiant makes this affidavit in support of an application for a search 
warrant for information associated with email account centralpark4804@gmail.com 
(“Target Account”), an account associated with STEPHEN PADDOCK, that is stored at 
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a premises owned, maintained, controlled, or operated by Google, Inc. (“Google”), an 
American multinational technology based in Mountain View, California that specializes 
in Internet-related services and products. Those services include, but are not limited to, 
online advertising technologies, a search engine, email services, cloud computing, and 
many other services. The information to be searched is described in the following 
paragraphs and in Attachment “A” (attached hereto and incorporated herein by 
reference). This affidavit is made in support of an application for a search warrant under 
18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A) to require Google to disclose to the 
government records and other information in its possession, pertaining to the subscriber 
or customer associated with the Target Account. 

2 . I am an “investigative or law enforcement officer of the United States” 
within the meaning of Title 18, United States Code, Section 2510(7), that is, an officer of 
the United States who is empowered by law to conduct investigations of, and to make 
arrests for, offenses enumerated in Title 18, United States Code, Section 2516. 

3. I have been employed as a Special Agent of the FBI for approximately five 
years, which began at the FBI Academy in October 2012. Upon completion of the 
academy, I was transferred to the Las Vegas Division's white collar crime squad and 
then the human trafficking squad. Since October 2015,1 have been assigned to the Las 
Vegas Division’s violent crime/gang squad. Additionally, I have been a certified member 
of the FBI's Cellular Analysis Survey Team since August 2015 due to my expertise in 
the field of historical cell site analysis. 

4. During my tenure with the FBI, I have conducted surveillance, analyzed 
telephone records, interviewed witnesses, supervised activities of sources, executed 
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search warrants, executed arrest warrants, and participated in court-authorized 
interceptions of wire and electronic communications. These investigative activities have 
been conducted in conjunction with a variety of investigations, to include those involving 
robbery, drug trafficking, kidnapping, murder, criminal enterprises, and more. In 
addition to my practical experiences, I received five months of extensive law enforcement 
training at the FBI Academy. 

5. The facts , in this affidavit are derived from your Affi ant’s personal 
observations, his training and experience, and information obtained from other agents, 
detectives, and witnesses. This affidavit is intended to show merely that there is 
sufficient probable cause for the requested warrant and does not set forth all of the 
Affiant’s knowledge about this matter. 

6 . Based on your Affiant’s training and experience and the facts as set forth 
in this affidavit, there is probable cause to believe that violations of: 

a. Destruction/Damage of Aircraft or Aircraft Facilities -18 U.S.C.A. § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee — 18 USC 922(a)(3) and (5). 

(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK and 

others yet unknown. There is also probable cause to search the information described in 

Attachment “A” for evidence of these crimes and information which might reveal the 

identities of others involved in these crimes, as described in Attachment “B” (attached 

hereto and incorporated herein by reference). 

/// 

3 






1 


PROBABLE CAUSE 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


7. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

8. LVMPD officers ultimately made entry into the room and located an 
individual later identified as Stephen Paddock. Paddock was deceased from an apparent 
self-inflicted gunshot wound. 

9. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 

10. On October 2, 2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms, Paddock’s vehicle at Mandalay Bay, and two Nevada residences owed 
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by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammunition and 100 
pounds of explosive material was found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of ammuni tion was located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

11. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

12. In an effort to determine whether or not STEPHEN PADDOCK was 
assisted and/or conspired with unknown individuals, investigators have attempted to 
identify all of STEPHEN PADDOCK’s communication facilities. Based on a review of his 
financial accounts, email address centralparkl@live.com (“Account 2”) was determined 
to belong to STEPHEN PADDOCK. On October 3, 2017, investigators requested an 
emergency disclosure of records from Microsoft related to Account 2 so it could be 
searched for any evidence of additional co-conspirators. Within the account, 
investigators identified the Target Account as one that required further investigation. 
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13. On July 6, 2017, the Target Account sent an email to Account 2 that read, 
“tiy an ar before u buy. we have huge selection, located in the las vegas area.” Later that 
day, Account 2 sent an email to the Target Account that read, “we have a wide variety 
of optics and ammunition to try.” And lastly. Account 2 later sent an email to the Target 
Account that read, “for a thrill try out burapfire ar’s with a 100 round magazine.” 

14. Based on the similarity of both email account names, investigators believe 
the Target Account may also be controlled by STEPHEN PADDOCK Additionally, 
STEPHEN PADDOCK was previously a manager of an apartment complex in the Reno, 
Nevada area called “Central Park,” which investigators believe further substantiates his 
association to the Target Account. However, investigators have been unable to figure out 
why STEPHEN PADDOCK would be exchanging messages related to weapons that were 
utilized in the attack between two of his email accounts. Conversely, if the Target 
Account was not controlled by STEPHEN PADDOCK, investigators need to determine 
who was communicating with him about weapons that were used in the attack. Paddock 
acquired a substantial amount of firearms from out of state which appear to have been 
transported into the state of Nevada where he resides. 

15. Your Affiant believes the requested search warrant will yield significant 
information from Google such as STEPHEN PADDOCKs contact list, email message 
content, IP address usage, photographs, third-party applications associated with the 
account, and more, which may constitute evidence of his planning of the attack and 
potentially identify other participants in the attack. Ultimately, your Affian t strongly 
believes the requested information will lead investigators to determine the full scope of 
STEPHEN PADDOCKs plan. 
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16. The following non-exhaustive list of definitions applies to this Affidavit and 

the Attachments to this Affidavit: 

a. The “Internet” is a worldwide network of computer systems operated 
by governmental entities, corporations, and universities. In order to access the Internet, 
an individual computer user must subscribe to an access provider, which operates a host 
computer system with direct access to the Internet. The World Wide Web is a 
functionality of the Internet which allows users of the Internet to share information. 

b. “Internet Service Providers” are companies that provide access to the 
Internet. ISPs can also provide other services for their customers including website 
hosting, email service, remote storage, and co-location of computers and other 
communications equipment. ISPs offer different ways to access the Internet including 
telephone-based (dial-up), broadband-based access via a digital subscriber line (DSL) or 
cable television, dedicated circuits, or satellite-based subscription. ISPs typically charge 
a fee based upon the type of connection and volume of data (bandwidth). Many ISPs 
assign each subscriber an account name, such as a user name, an email address, and an 
email mailbox, and the subscriber typically creates a password for his/her account. 

c. “ISP Records” are records maintained by ISPs pertaining to their 
subscribers (regardless of whether those subscribers are individuals or entities). These 
records may include account application information, subscriber and billing information, 
account access information (often in the form of log files), emails, information concerning 
content uploaded and/or stored on the ISP’s servers, and other information, which may 
be stored both in computer data format and in written or printed record format. ISPs 
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reserve and/or maintain computer disk storage space on their computer system for their 
subscribers’ use. This service by ISPs allows for both temporary and long-term storage 
of electronic communications and many other types of electronic data and files. 

d. “Online service providers” (also referred to here as “service 
providers”) are companies that provide online services such as email, chat or instant 
messaging, word processing applications, spreadsheet applications, presentation 
applications similar to PowerPoint, online calendar, photo storage and remote storage 
services. Sometimes they also can provide web hosting, remote storage, and co-location 
of computers and other communications equipment. Typically, each service provider 
assigns each subscriber an account name, such as a user name or screen name and the 
subscriber typically creates a password for his/her account. 

e. “Computer,” as used herein, is defined as “an electronic, magnetic, 
optical, electrochemical, or other high speed data processing device performing logical or 
storage functions, and includes any data storage facility or communications facility 
directly related to or operating in conjunction with such device.” 

f. A “server” is a centralized computer that provides services for other 
computers connected to it via a network. The other computers attached to a server are 
sometimes called “clients.” For example, in a large company, it is common for individual 
employees to have client computers at their desktops. When the employees access their 
email, or access files stored on the network itself, those files are pulled electronically 
from the server, where they are stored, and are sent to the client’s computer via the 
network. Notably, servers can be physically stored in any location: it is not uncommon 
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for a network’s server to be located hundreds (and even thousands) of miles away from 
the client computers. 


g. “Internet Protocol address,” or “IP address ” refers to a unique 
number used by a computer to access the Internet. IP addresses can be dynamic, 
meaning that the Internet Service Provider (ISP) assigns a different unique number to 
a computer every time it accesses the Internet. IP addresses might also be static, that 
is, an ISP assigns a user’s computer a particular IP address which is used each time the 
computer accesses the Internet. 

h. The term “domain” refers to a word used as a name for computers, 
networks, services, etc. A domain name typically represents a website, a server computer 
that hosts that website, or even some computer (or other digital device) connected to the 
internet. Essentially, when a website (or a server computer that hosts that website) is 
connected to the internet, it is assigned an IP address. Because IP addresses are difficult 
for people to remember, domain names are instead used because they are easier to 
remember than IP addresses. Domain names are formed by the rules and procedures of 
the Domain Name System (DNS). A common top level domain under these rules is “.com” 
for commercial organizations, “.gov” for the United States government, and “.org” for 
organizations. For example, www.usdoi.gov is the domain name that identifies a server 
used by the U.S. Department of Justice, and which uses IP address of 149.101.46.71. 

i. “Web hosting services” maintain server computers connected to the 
Internet. Their customers use those computers to operate websites on the Internet. 
Customers of web hosting companies place files, software code, databases, and other data 
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on servers. To do this, customers typically connect from their own computers to the 
server computers across the Internet. 

j. The term “Whols” lookup refers to a search of a publicly available 
online database that lists information provided when a domain is registered or when an 
IP address is assigned. 

k. The terms “communications,” “records,” “documents,” “programs,” or 
“materials” include all information recorded in any form, visual or aural, and by any 
means, whether in handmade form (including, but not limited to, writings, drawings, 
paintings), photographic form (including, but not limited to, pictures or videos), or 
electrical, electronic or magnetic form, as well as digital data- files. These terms also 
include any applications (i.e. software programs). These terms expressly include, among 
other things, emails, instant messages, chat logs, correspondence attached as to emails 
(or drafts), calendar entries, buddy lists. 

l. “Chat” is usually a real time electronic communication between two 
or more individuals. Unlike email, which is frequently sent, then read and responded to 
minutes, hours, or even days later, chats frequently involve an immediate conversation 
between individuals, similar to a face-to-face conversation. Nearly all chat programs are 
capable of saving the chat transcript, to enable users to preserve a record of the 
conversation. By default, some chat programs have this capability enabled, while others 
do not. Many popular web-based email providers, like Google and Google, provide chat 
functionality as part of the online services they provide to account holders. 

Ill 

/// 
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17. In my training, my experience and this investigation, I have learned that 
Google (the Service Provider) is a company that provides free web-based Internet email 
access to the general public, and that stored electronic communications, including 
opened and unopened email for Google subscribers may be located on the computers of 
Google. I have also learned that Google Inc. provides various on-line service messaging 
services to the general public. Instant Messaging ( K IM”) is a form of real-time direct text- 
based communication between two or more people using shared clients. The text is 
conveyed via devices connected over a network such as the Internet. In addition to text, 
Google’s software allows users with the most current updated versions to utilize its 
webcam service. This option enables users from distances all over the world to view 
others who have installed a webcam on their end. Thus, the Service Providers servers 
will contain a wide variety of the subscriber’s files, including emails, address books, 
contact or buddy lists, calendar data, pictures, chat logs, and other files. 

18. To use these services, subscribers register for online accounts like the 
Target Account. During the registration process, service providers such as the ones here 
ask subscribers to provide basic personal information. This information can include the 
subscriber’s full name, physical address, telephone numbers and other identifiers, 
alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit card or bank account number). Based on my training and my 
experience, I know that subscribers may insert false information to conceal their 
identity; even if this proves to be the case, however, I know that this information often 
provide clues to their identity, location or illicit activities. 
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19. In general, when a subscriber receives an email, it is typically stored in the 
subscriber’s “mail box” on that service provider’s servers until the subscriber deletes the 
Email. If the subscriber does not delete the message, the message (and any attachments) 
can remain on that service provider’s servers indefinitely. 

20. Similarly, when the subscriber sends an email, it is initiated at the 
subscriber’s computer, transferred via the Internet to the service provider’s servers, and 
then transmitted to its end destination. That service provider often saves a copy of the 
email sent. Unless the sender of the email specifically deletes the Email from the 
provider’s server, the email can remain on the system indefinitely. 

21. A sent or received email typically includes the content of the message, 
source and destination addresses, the date and time at which the email was sent, and 
the size and length of the email. If an email user writes a draft message but does not 
send it, that message may also be saved by that service provider, but may not include all 
of these categories of data. 

22. Just as a computer on a desk can be used to store a wide variety of files, so 
can online accounts, such as the accounts subject to this application. First, subscribers 
can store many types of files as attachments to emails in online accounts. Second, 
because service providers provide the services listed above (e.g. word processing, 
spreadsheets, pictures), subscribers who use these services usually store documents on 
servers maintained and/or owned by service providers. Thus, these online accounts often 
contain documents such as pictures, audio or video recordings, logs, spreadsheets, 
applications and other files. 
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23. Reviewing files stored in online accounts raises many of the same 
difficulties as with reviewing files stored on a local computer. For example, based on my 
training, my experience and this investigation, I know that subscribers of these online 
I services can conceal their activities by altering files before they upload them to the online 
service. Subscribers can change file names to more innocuous sounding names (e.g. 
renaming “FraudRecords.doc” to “ChristmasList.doc”), they can change file extensions 
to make one kind of file appear like a different type of file (e.g. changing the spreadsheet 
“StolenCreditProfiles.xls” to “FamilyPhoto.jpg” to appear to be a picture file, where the 
file extension “.xls” denotes an Excel spreadsheet file and “.jpg” a JPEG format image 
file), or they can change the times and dates a file was last accessed or modified by 
changing a computer’s system time/date and then uploading that file to the Online 
Accounts. Thus, to detect any files that the subscriber may have concealed, agents will 
need to review all of the files in the Target Account; they will, however, only seize the 
items that the Court authorizes to be seized. Similarly, subscribers can conceal their 
activities by encrypting files. Thus, these files may need to be decrypted to detect 
whether it constitutes an Item to be Seized. 

24. I also believe that people engaged in crimes such as the one described 
herein often use online accounts because they give people engaged in these crimes a way 
to easily communicate with other co-conspirators. Moreover, online accounts are easily 
concealed from law enforcement. Unlike physical documents, electronic documents can 
be stored in a physical place far away, where they are less likely to be discovered. 

25. Service providers typically retain certain transactional information about 
the creation and use of each account on their systems. This information can include the 
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date on which the account was created, the length of service, records of log-in (i.e., 
session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the 
account (such as logging into the account via websites controlled by the Service 
Provider), and other log files that reflect usage of the account. In addition, service 
providers often have records of the Internet Protocol address (“IP address”) used to 
register the account and the IP addresses associated with particular logins to the 
account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to 
access the online account. 

26. In some cases, subscribers will communicate directly with a service 
provider about issues relating to the account, such as technical problems, billing 
inquiries, or complaints from or about other users. Service providers typically retain 
records about such communications, including records of contacts between the user and 
the provider’s support services, as well records of any actions taken by the provider or 
user as a result of the communications. 

27. In my training and experience, evidence of who was using an online 
account may be found in address books, contact or buddy fists, emails in the account, 
and pictures and files, whether stored as attachments or in the suite of the service 
provider’s online applications. Therefore, the computers of the Service Providers are 
likely to contain stored electronic communications (including retrieved and un-retrieved 
email for their subscribers) and information concerning subscribers and their use of the 
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1 provider’s services, such as account access information, email transaction information, 

2 documents, pictures, and account application information. 

3 IN FORMATION TO BE SEARCHED AND THTNQS TO RE SEIZFn 

4 28. Your Affiant anticipates executing this warrant under the Electronic 

5 Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 

6 2703(c)(1)(A), by using the warrant to require Google to disclose to the government copies 

7 of the records and other information (including the content of communications) 

8 particularly described in Section I of Attachment “B.” Upon receipt of the information 

9 described in Section I of Attachment “B,” government-authorized persons will review 
10 that information to locate the items described in Section II of Attachment “B.” 


12 29 - Based on the forgoing, I request that the Court issue the proposed search 

13 warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 

14 of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 

15 & (c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 

16 jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 

17 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 

18 service or execution of this warrant. 

19 REQUEST FOR SEALING 

20 30. I further request that the Court order that all papers in support of this 

21 application, including the affidavit and search warrant, be sealed until further order of 

22 the Court. These documents discuss an ongoing criminal investigation that is neither 

23 public nor known to all of the targets of the investigation. Accordingly, there is good 
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ATTACHMENT "A” 

ONLINE ACCOUNT TO BE SEARCHED 

1. This warrant applies to information associated with the Google email 
account centralpark4804@gmail.com (the “Target Account”) from its inception to 
present, which is stored at premises owned, maintained, controlled, or operated by 
Google, Inc., headquartered at 1600 Amphitheatre Way, Mountain View, California, 
94043. 
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ATTACHMENT “B” 
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To the extent that the information described in Attachment A is within the 
possession, custody, or control of Google, including any Emails, records, files, logs, or 
information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 
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a. The contents of all emails associated with the account, including copies of 
emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at 
which each email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other 
identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means 
and source of payment (including any credit or bank account number); 

c. All records or other information stored in the Online Accounts, including 
address books, contact and buddy lists, calendar data, pictures, 
applications, documents, and other files; 

d. All records pertaining to communications between Service Provider and 
any person regarding the account, including contacts with support services 
and records of actions taken. 

e. All third-party application data and content associated with the Target 
Account through any Android operating system and/or any Google-related 
facility. 
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After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Tramsport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses’ 5 ) that occur in the 
form of the following, from account inception to present: 


a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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ATTACHMENT “C” 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 


4 1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 

5 in response to this search warrant (“the Search Warrant Data”) those categories of data, 

6 files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 

7 privileged, or confidential files to the extent reasonably practicable. 
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2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of t his warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 

on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 
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7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 
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b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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STEVEN W. MYHRE 
Acting United States Attorney 
District of Nevada 
Cristina D. Silva 
Patrick Burns 

Assistant United States Attorneys 
501 Las Vegas Blvd. South, Ste. 1100 
Las Vegas, Nevada 89101 
TeJephone: (702) 388-6336 
Fax (702) 388-6698 
CSilva@usa.doi.gov 
iohn.D.burns@usdoi.gov 

Representing the United Stales of America 

UNITED STATES DISTRICT COURT 
DISTRICT OF NEVADA 
-oOo- 
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IN THE MATTER OF THE SEARCH OF: 

THE PREMISES KNOWN AS: 

1372 BABBLING BROOK COURT, 
MESQUITE, COUNTY OF CLARK, 
STATE OF NEVADA. 


Magistrate No. 

AFFIDAVIT IN SUPPORT OF 
SEARCH WARRANT 


(Under Seal) 


STATE OF NEVADA ) 

) ss: 

COUNTY OF CLARK ) 

AFFIDAVIT IN SUPPORT OF SEARCH WARRANT 


1. I, Christopher W. McPeak, Special Agent, Federal Bureau of Investigation (FBI), 
having been duly sworn, hereby depose and say: 

2. Your Affiant is a Special Agent with the FBI currently assigned to the Las Vegas, 
Nevada Division and has been so employed for over eight years. Prior to this he was employed 
for over five years as a Deputy Sheriff and Detective with the Orange County, Florida Sheriff's 
Office. As an FBI Agent, your Affiant is assigned to the FBI’s Las Vegas Safe Streets Task Force 
(LVSSTF) and is responsible for investigating a variety of violent crimes, to include bank 
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robbery, kidnapping, extortion, robbery, carjackings, assaults and murders of federal officers ; 
racketeering related violent offenses, as well as long-term investigations into the activities and 
operations of career criminals, criminal enterprises, drug trafficking organizations, and violent 
street gangs. Your Affiant has experience in conducting criminal investigations, including the 
investigation of criminal groups and conspiracies as well as the collection of evidence and the 
identification and use of witnesses. 

3. The facts in this affidavit are derived from your Affiant’s personal observations, 
his training and experience, and information obtained from other agents, detectives, and 
witnesses. This affidavit is intended to show merely that there is sufficient probable cause for 
the requested warrant and does not set forth all of the Affiant’s knowledge about this matter. 

PREMISES TO BE SEARCHED 

4. The proposed search warrant seeks authorization to search the premises identified 
as 1372 Babbling Brook Court, Mesquite, Clark County, Nevada (hereinafter referred to as the 
“subject premises”), more fully described in Attachment “A” (attached hereto and incorporated 
herein by reference). 

REQUEST FOR SEARCH WARRANT 

5. Based on your Affiant’s training and experience and the facts as set forth in this 
affidavit, there is probable cause to believe that violations of, inter alia: 

a. Destruction/Damage of Aircraft or Aircraft Facilities - IS U.S.C. § 32(a); 

b. Violence at an International Airport - 18 U.S.C. § 37(a)(2); 

c. Unlawful Interstate Transport/Delivery of Firearms by Non-Federal 
Firearms Licensee - 18 U.S.C. § 922(a)(3) and (5); and 

d. Aiding and Abetting - 18 U.S.C. § 2, 

(hereinafter referred to as the “subject offenses”) have been committed by Stephen Paddock and 
others yet unknown; and this affidavit is made in support of an application for a search warrant 
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AO 106 (Rev. 04/10) Application fora Search Warrant 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 

INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: Mariloudanley 


United States District -_ l s .' $ r n . - 

that the foregoing document is a full true and correct 
for the copy of the original on file in my office, and in my legal 

District of Nevada . custody ' 

. CAM FERENBACH 
U.S. MAGISTRATE JUDGE 

) District of Nevada 


Case No. Ry 2:l7-mj-00QSp,YQr_ 


_D«viiy 

Secretary 


A2 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of peijury that I have reason to believe that on the following person or property (identify the person or describe the 

AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: Mariloudanley 
A2 


located in the 


DEA 


District of 


, there is now concealed (identify the 


person or describe the property to be seized): 

INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: Mariloudanley 
A2 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
fif evidence of a crime; 

contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
sf a person to be arrested or a person who is unlawfully restrained. 
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The search is related to a violation of: 


Code Section 

Title 26, United States Code, 
Section 5841. 


Offense Description 
Violation of National Firearms Act 
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The application is based on these facts: . . 

I believe there is probable cause to believe that in the subject accounts listed in Attachments A1 , “A2 , ‘A3 , 

"A4", "A5* there is proof that constitutes evidence of the commission of criminal offense(s); contraband, the fruits 
of crime and things otherwise criminally possessed and been used as the means of committing criminal offense(s) 
□ Continued on the attached sheet. 


_ days (give exact ending date if more than 30 days: _ 
under 3 8 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


□ Delayed notice of 


) is requested 


M- 


Applicant's signature 


Sworn to before me and signed in my presence. 
Date: 


City and state: L8S Nmfa 


Printed name and title 


CAM FERENBACH 
U.S. MAGISTRATE JUDGF 

Printed name and title 
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that the foregoing document is a full true and correct 

United States District g lff ^ inal <**<*. ^ *> ^ 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

Mariloudanley A2 


for the 

District of Nevada 


) 

) 

) Case No. 

) 

) 

) 


By. 


A 


CAM FERENBACH 
U.S. MAGISTRATE JUDGE 
DISTRICT OF NEVADA 


—/Dei 

"^Se, 


puty 
Secretary 


2:17-mj-00959-VCF 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of _ Nevada 

(identify the person or describe the property to be searched and give its location)'. 

SEE ATTACHMENT A2 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search wi 11 reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS Band C 


YOU ARE COMMANDED to execute this warrant on or before l^~^( / _ (not to exceed 14 days) 

in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventoiy 
as required by law and promptly return this warrant and inventory to_ CAM F£REMdAv..H _. 

• (United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed JO) □ until, the facts justifying, the later specific date of ___. 


Date and time issued: 





City and state: Las Vegas, Nevada 


CAM FERENBACH 



U.S. MAGISTRATE JUDGE 


Printed name end title 






SEALED 


Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 
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Attachment “A2” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs mariioudanley, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 
headquartered in Menlo Park, California for the time period beginning September 1, 2016 to present. 
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ATTACHMENT “B” 

Particular Things to be Seized 
I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Instagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved pursuant 
to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1,2016 to present: 

(a) All contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, Instagram 
passwords, Instagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other Instagram activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending “Friend” requests; 
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All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

All IP logs, including all records of the IP addresses that logged into the account; 

All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has ‘liked”; 

All location data associated with the account, including geotags; 

All data and information that has been deleted by the user; 

All past and present lists of friends created by the account; 

All records of Instagram searches performed by the account; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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II. Information to be seized by the gover nm ent 

All information described above in Section I that constitutes fruits, evidence, and instrumentalities 
of violations of: 

Violation of National Firearms Act - Registration of Firearms, Title 26, United States Code, 
Section 5841. 

involving STEPHEN PADDOCK and others yet unidentified, including, for each user ID identified 
on Attachment “A,” information pertaining to the following matters: 

(a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 
accessories, ammunition, or explosives by Paddock, including through conspiring and 
cooperating to possess, use, purchase, or sell prohibited firearms, firearms 
accessories, ammunition, or explosives. 

(b) Evidence indicating how and when the Instagram account was accessed or used, to 
determine the chronological and geographic context of account access, use, and 
events relating to the crime under investigation and to the Facebook account owner; 

(c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 
crime under investigation; 

(d) The identity of the person(s) who created or used the user ED, including records that 
help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ED about matters 
relating to the illegal possession, purchase, use, or sale of firearms, firearms 
accessories, ammunition, or explosives, including records that help reveal their 
whereabouts. 

The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
separately sealed, as though set forth fully herein. 
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ATTACHMENT C 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimiz ing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy”)- The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy, or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents Will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section II. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document,- data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 


19 







1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant. The time for executing the warrant in Rule 41(e)(2)(A) and 
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(f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 
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a. Pursuant to Rule 41 (e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the executipn of the warrant, the inventory will be filed. 


13 

14 

15 

16 

17 

18 

19 

20 


b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the ‘later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41 (f)(1)(B), the inventory return that is to be filed with the court may be 
limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

Under Rule 41(f)(1)(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 
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If the person from whom any Search Warrant Data was seized requests the return of any 
information in the Search Warrant Data that is not set forth in Attachment B, Section II, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District 


for the 

District of Nevada 


that the foregoing document is a full true and correct 
copy of the original on file in my office, and in my legal 
custody. 


In the Matter of the Search of 

(Briefly describe the properly to be searched 
or identify the person by name and address) 


INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: Mariloudanleyy A3 


) 

) 

) 

) 

) 

) 


CAM FE REN BACH 
U S. MAGISTRATE JUDGE 
DISTRICT OF NEVADA 

Case No. fcI7-mj-00960-VCF ^epo.y 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

pr \Wt AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: 
Mariloudanleyy A3 

located in the 


DEA 


District of 


, there is now concealed (identify the 


person or describe the property to be seized): 

INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: Mariloudanleyy 
A3 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

^ evidence of a crime; 

fif contraband, fruits of crime, or other items illegally possessed; 

property designed for use, intended for use, or used in committing a crime; 
&(a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

Title 26, United States Code, Violation of National Firearms Act 
Section 5841. 


The application is based on these facts: „ . „ 

I believe there is probable cause to believe that in the subject accounts listed in Attachments “A1 , “A2 , A3 , 

“A4", "A5" there is proof that constitutes evidence of the commission of criminal offense(s); contraband, the fruits 
of crime and things otherwise criminally possessed and been used as the means of committing criminal offense(s) 
O Continued on the attached sheet. 

O Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 

_ M _ 

Applicant's signature 


Printed name and tide 


Swom to before me and signed in my presence. 


Date: [0^^^ I'J 

City and state[ as Vegas, Nevada 


CAM FEREN8ACH 

cdHttftiRBRCH 

_U.s. M AGIST RATE judge 

Printed name and title 





AO 93 (Rev M/13)Search and Seizure Warrant 


United States District Court 

for the 

District of Nevada 

In the Matter of the Search of 

(Briefly describe the pro/ierty to be searched 
or identify the person by name and address) 

1372 BABBLING BROOK COURT, 

MESQUITE. COUNTY OF CLARK,STATE OF NEVADA 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the District of Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A 


) 

) Case No. 2:17-mj- jc 

) 

) 

) 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify thejwrson or describe the property to be sc ted): 


SEE ATTACHMENTS B 


yi 5u ARE COMMANDED to execute this warrant on or before C cLl+j: rjX’ i ( (not to exceed 14 days) 

d in the daytime 6:00 a.m. to 10:00 p.m. O at any lime in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the wairaut, must prepare an inventory 
as required by law and promptly return this warrant and inventory to rf K 

^ \\/DoitcdStates Mcfei.jfrate judge) 

O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may havc^n adverse result listed in 18 U.S.C. 
ij 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

n for days (not to exceed SO) Cl until, the facts justifying, the later specific date of 


Date and time issued: 


City and stale: 




Attachment "A' 


Description of Propertv/Premise to be Searched 

. 1372 Babbling Brook Court 

Mesquite, Clark County, Nevada 

The subject premises is described as a one story, single family residence of apparent 
stucco frame construction. The premises are situated in the northeast corner Babbling Brook 
Court, which is a cul-de-sac. The premises faces approximately southwest and is located 
approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. 
The residence is painted tan and the house numbers “1372” are affixed to the exterior wall 
facing the street. 
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Attachment "B 1 


Particular Items to be Seized 

a thorough, microscopic examination and documentation of the subject premises 
to discover trace evidence, including but not limited to: fingerprints, blood, hair, 
fibers and other bodily fluid samples; 

firearms to include handguns, shotguns and rifles, spent casings or live 
ammunition for the same, firearm accessories such as magazines or cylinders, 
firearm cleaning materials, and paperwork associated with the ownership of 
firearms; 

United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds, securities, 
cashiers checks, money drafts, and letters of credit; 

books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories, 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 

books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and /or expenditure of money; 

any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives, explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 

any and all records relating to the medical or psychological/psychiatric treatment 
of Stephen Paddock or Marilou Danley; 

all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 

cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, e-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists; 
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k. papers, tickets, notes, receipts, and other items relating to domestic and 
international travel. 

l. any and all electronic storage devices, including: computer hard drives and 
external memory devices such as floppy disks, “thumb drives” (USB electronic 
storage drives), and compact disk “CD” anchor “DVD” storage devices. 3 

m. records evidencing occupancy or ownership of the premises described above, 
including, but not limited to, utility and telephone bills, mail envelopes, or 
addressed correspondence; 

n. records or other items which evidence ownership or use of computer equipment 
found in the target location, including, but not limited to, sales receipts, bills for 
Internet access, and handwritten notes; 

o. any and all records pertaining to the rental of self-storage units and post office 
boxes; 

p. chemicals and other compounds which may constitute explosives or explosive 
precursors; and 

q. improvised, commercial or military grade explosive devices, detonators, initiators, 
any components thereof, or any other weapon of mass destruction. 
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3 Electronic equipment shall be seized, but not searched. Supplemental search warrant will be requested 
prior to the searching of seized electronic items. 
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IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 

stephenpaddock47 A1 


IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 


Magistrate No. 


AFFIDAVIT 


(Under Seal) 
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Magistrate No. __ 

AFFIDAVIT 
(Under Seal) 


Mariloudanley A2 


IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 


Magistrate No. _ 
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IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 

Mariloudanleypaddock A4 


Magistrate No a/7ffi ^961-V CF 

u - s aM3%?$iz " d ' 53 
sy n 

(fhwiej^Seal) 


IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 

marilou.danley A5 

STATE OF NEVADA ) 

) ss: 

COUNTY OF CLARK ) 


Magistrate No. 


2:17-mj-00962-VCF 


AFFIDAVIT 


(Under Seal) 


AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT 


I, Heather D. Burton, Special Agent, Federal Bureau of Investigation (FBI), having been duly 
sworn, hereby depose and say: 


INTRODUCTION AND AGENT BACKGROUND 


1. Your Affiant is a Special Agent with the FBI currently assigned to the Las Vegas, 

Nevada Division. She has been so employed for over three years. Prior to this she, was employed 
for five years as a United States Probation Officer in Memphis, Tennessee. Your Affiant is 
currently assigned to FBI Las Vegas Squad 6. Previously, she was assigned to the Las Vegas Safe 
Streets Task Force (LVSSTF) and was responsible for investigating a variety of violent crimes, to 
include bank robbery, kidnapping, extortion, robbery, carjacking, assault and murder of Federal 
Officers, racketeering related violent offenses, as well as long-term investigations into the activities 
and operations of criminal enterprises, drug trafficking organizations, and violent street gangs. 

Your Affiant has experience in conducting criminal investigations, including the investigation of 
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criminal groups and conspiracies as well as the collection of evidence and the identification and use 
of witnesses. 

2. Your Affiant makes this affidavit in support of an application for a search warrant for 
information associated with certain Instagram, LLC (hereinafter “Instagram”) user IDs that are 
stored at premises owned, maintained, controlled, or operated by Facebook Inc. (hereinafter 
“Facebook”), a social networking company headquartered in Menlo Park, California. The 
information to be searched is described in the following paragraphs and in Attachment Al, A2, A3, 
A4, A5 and B. This affidavit is made in support of an application for a search warrant under 18 
U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Facebook to disclose to the 
government records and other information in its possession, pertaining to the subscriber or customer 
associated with user IDs. It is submitted that the information sought through the issuance of the 
requested warrant constitutes evidence of the following offense: Violation of National Firearms Act 
- Registration of Firearms, Title 26, United States Code, Section 5841. 

3. The items to be searched are the associated Instagram user ID names as follows: 
stephenpaddock47 

mariloudanley 

mariloudanleyy 

marilondanleypaddock 

marilou.danJey 

4. Because this affidavit is being submitted for the limited purpose of securing a search 
warrant, your Affiant has not included each and every fact known to her concerning this 
investigation. Your Affiant has set forth only those facts that are necessary to establish probable 
cause for the above listed offense. The information used to support this search warrant was derived 
from reports of information obtained from witnesses as well as investigation conducted by other 
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Agents and law enforcement officers related to the incident. This affidavit contains information 
necessary to support probable cause to believe that the criminal offenses described herein were 
committed by the defendant, STEPHEN PADDOCK (hereinafter “PADDOCK”), and others yet 
unidentified, and is not intended to include each and every fact and matter observed by your Affiant 
or known to the Government. Moreover, to the extent this affidavit contains statements by witnesses, 
those statements are set forth only in part in substance and are intended to accurately convey the 
information, but not to be verbatim recitations. All noted times are approximate. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711 and 18 U.S.C. §§ 2703(a), (b)(1)(A), and 
(c)(1)(A). Specifically, the Court is a “district court of the United States (including a magistrate 

judge of such a court) that... has jurisdiction over the offense being investigated_”18 U.S.C. § 

271 l(3)(A)(i), which took place in Las Vegas, Nevada. 

BACKGROUND CONCERNING INSTAGRAM 

6. Instagram, which is owned by Facebook, operates a ffee-access social-networking 
website of the same name that can be accessed at http://www.instagram.com. Instagram allows its 

I users to create their own profile pages, which can include a short biography, a photo of themselves, 
videos and other information. Users can access Instagram through its website or by using a special 
electronic application ("app") created by the company that allows users to access the service through 
a mobile device. 

7. Instagram permits users to post photos and videos to their profiles on Instagram and 
otherwise share them with others on Instagram, as well as certain other social-media services, 
including Flickr, Facebook, and Twitter. When posting or sharing a photo or video on Instagram, a 
user can add a caption to it, can add various "tags" that can be used to search for the photo or video 
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| ( e -g-> a user may add the tag #vw to a photo so that people interested in Volkswagen vehicles can 
search for and find the photo), can add location information, and can add other information, as well 
as apply a variety of "filters" or other visual effects that can be used to modify the look of the posted 
photos. In addition, Instagram allows users to make comments on posted photos or videos, 
including photos or video that the user posts or posted by other users of Instagram. Users can also 
"like" photos. 

8. Upon creating an Instagram account, an Instagram user must create a unique 

Instagram username and an account password. This information is collected and maintained by 

_ 

Instagram. 

9. Instagram asks users to provide basic identity and contact information upon 
registration and also allows users to provide additional identity information for their user profile. 
This information may include the user’s full name, e-mail address(es), and phone numbers), as well 
as potentially other personal information provided directly by the user to Instagram. Once an 
account is created, users may also adjust various privacy and account settings for the account on 
Instagram. This information is collected and maintained by Instagram. 

10. Instagram allows users to have "friends," which are other individuals with whom the 
user can share information without making the information public. Friends on Instagram may come 
from either contact lists maintained by the user, other third-party social media websites and 
information, or searches conducted by the user on Instagram profiles. This information is collected 
and maintained by Instagram. 

11. Instagram also allows users to "follow" another user, which means that they receive 
updates about posts made by the other user. Users may also "unfollow" users, that is, stop following 
them or block them, which prevents the blocked user from following that user. 

12. Instagram allows users to post and share various types of user content, including 
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photos, videos comments, and other materials. User content that is posted to Instagram or shared 
through Instagram is collected and maintained by Instagram. 

13. Instagram users can exchange private messages on Instagram with other users. These 
messages, which are similar to email messages, are sent to the recipient’s “Inbox” on Instagram, 
which also stores copies of messages sent by the recipient, as well as other information. 

14. Users on Instagram may also search Instagram for other users or particular types of 
photos or other content. 

For each user, Instagram also collects and retains information, called "log file" 
information, every time a user requests access to Instagram, whether through a web page or through 
an app. Among the log file information that Instagram's servers automatically record is the 
particular web requests, any Internet Protocol (“IP”) address associated with the request, type of 
browser used, any referencing/exit web pages and associated URLs, pages viewed, dates and times 
of access, and other information. 

16. Instagram also collects and maintains "cookies,” which are small text files that are 
placed on a user's computer or mobile device and that allows Instagram to identify the browser or 
device's accesses to the service. 

17. Instagram also collects information on the particular devices used to access 
Instagram. In particular, Instagram may record "device identifiers," which includes data files and 
other information that may identify the particular electronic device that was used to access 
Instagram. 

18. Instagram also collects metadata associated with user content. For example, 

Instagram collects any "hashtags" associated with user content (i.e., keywords used), "geotags" that 
mark the location of a photo and which may include latitude and longitude information, comments 
on photos, and other information. 
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19. Instagram also may communicate with the user, by email or otherwise. Instagram 
collects and maintains copies of communications between Instagram and the user. 

20. Based on the information above, the computers of Instagram are likely to contain all 
the material described above with respect to accounts with the above referenced user IDs, including 
Stephenpaddock47, mariloudanley, mariloudanleyy, mariloudanleypaddock, and 
marilou.danley, including stored electronic communications and information concerning 
subscribers and their use of Instagram, such as account access information, which would include 
information such as the IP addresses and devices used to access the account, as well as other account 
information that might be used to identify the actual user or users of the accounts at particular times. 

STATEMENT OF PROBABLE CAUSE 

21. On the evening of Sunday, October 1,2017, the Route 91 Harvest, a music festival, 
was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada 89119. At approximately 
2208 hours, the Las Vegas Metropolitan Police Department (LVMPD) received calls reporting shots 
had been fired at the concert and multiple victims were struck. LVMPD determined the shots were 
coming from Rooms 134 and 135 on the 32nd floor of the Mandalay Bay Resort and Casino, 3950 
South Las Vegas Boulevard, Las Vegas, Nevada 89119. 

22. Officers made entry into the room and located an individual later identified as 

Stephen Paddock, address 1372 Babbling Brook Court, Mesquite, Nevada 89034. 

Paddock was deceased from an apparent self-inflicted gunshot wound. 

23. Officers found multiple firearms and hundreds of rounds of ammunition in the room 
in close proximity to Paddock’s body. Additionally, investigators located over a thousand rounds of 
ammunition and explosive material in a vehicle associated with Paddock. Further, multiple firearms 
and a large quantity of ammunition were located at Paddock’s residence at 1372 Babbling Brook 
Court, Mesquite. 
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24. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel room with 
Paddock, and both hotel rooms were registered in his name. A player’s club card in name of Mariiou 
Danley was located in Paddock’s room, and the card returned to the same Babbling Brook address in 
Mesquite. 

25. While monitoring an identified Facebook accounts of Mariiou Danley 
(facebook.com/marilou.danley) after the shooting, LVMPD investigators noted that the account 
settings and privacy settings were changed on October 2,2017, at approximately 0030 hours. At 
approximately 0246 hours, the Facebook account was deleted. Investigators discovered the 
following additional Instagram accounts associated with Stephen Paddock and Mariiou Paddock: 
stephenpaddock47, mariloudanley, mariloudanleyy, mariloudanleypaddock, and 
marilou.danley. On October 3,2017, a preservation request for all content pertaining to the these 
Instagram was submitted to Facebook to maximize the chance that the contents of the account 
remain preserved. 

26. Based on my training and experience, a person who possesses large amounts of 
firearms and ammunition obtains those items over a period of time. Thus, I am requesting that the 
search period be from September 1,2016 to the present. 

27. Based on these stated facts, it is your Affiant’s opinion that there is probable cause to 
believe that the Instagram accounts with user IDs $tephenpaddock47, mariloudanley, 
mariloudanleyy, mariloudanleypaddock, and marilou.danley contain evidence related to 
PADDOCK’S possession of firearms in violation of Title 26, United States Code, Section 5841. 

Your Affiant also submits that a review of photos and other non-public content on the subject 
accounts will likely produce further evidence of prior and additional violations of the enumerated 
offenses. I swear, under penalty of peijury, that the foregoing is true and correct to the best of my 
knowledge and belief. 


8 






1 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


INFORMATION TO BE SEARCHED AND THINGS TO BF. SEIZED 

28. Your Affiant anticipates executing this warrant under the Electronic Communications 
Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the 
warrant to require Facebook to disclose to the government copies of the records and other 
information (including the content of communications) particularly described in Section I of 
Attachment “B.” Upon receipt of the information described in Section I of Attachment “B,” 
government-authorized persons will review that information to locate the items described in Section 
n of Attachment “B.” 

CONCLUSION 

29. Based on the information set forth herein. Your Affiant has probable cause to believe 
that in the subject accounts listed in Attachments “Al”, “A2”, “A3”, “A4”, “A5” there is proof that 
constitutes evidence of the commission of criminal offense(s); contraband, the fruits of crime and 
things otherwise criminally possessed; and property designed or intended for use or which is or has 
been used as the means of committing criminal offense(s). The evidence to be searched for and 
seized is set forth in Attachment "B", which is attached hereto and incorporated herein by reference. 

30. Based on the forgoing, your Affiant requests that the Court issue the proposed search 
warrant. 
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targets of the investigation. Accordingly, there is good cause to seal these documents because their 
premature disclosure may seriously jeopardize that investigation. 


Respectfully Submitted, 


Heather D. Burton, Special Agent 
Federal Bureau of Investigation 


SWORN TO AND SUBSCRIBED 
before me this 3 vy aay of October, 2017. 


CAM FERENBACH 


UNITED STATES MAGISTRATE JUDGE 


I hereby attest and certify on _ f/) 

that the foregoing document is a full true and com 
copy of the original on file in my office, and in my iet al 
custody. 




CAM FERENBACH 
U.S. MAGISTRATE JUDGE 
DISTRICT OF NEVADA 
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Attachment “Al” 
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Attachment “A2” 


Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs mariloudanley, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 
headquartered in Menlo Park, California for the time period beginning September 1,2016 to present. 
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Attachment “A3” 


Property to Be Searched 


This warrant applies to information associated with the Instagram user IDs mariloudanleyy, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 
headquartered in Menlo Park, California for the time period beginning September 1,2016 to present 
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( Attachment “A4” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs 
mariloudanleypaddock, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
September 1,2016 to present. 
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Attachment “AS” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs and 
raarilou.danley that is stored at premises owned, maintained, controlled, or operated by Facebook, a 
company headquartered in Menlo Park, California for the time period beginning September 1, 2016 


to present 
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ATTACHMENT “B” 

Particular Things to be Seized 
L Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Instagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved pursuant 
to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1, 2016 to present: 

(a) All contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, Instagram 
passwords, Instagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other Instagram activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) AH profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending “Friend” requests; 
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(f) All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

(g) All IP logs, including all records of the IP addresses that logged into the account; 

(h) All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

(i) All location data associated with the account, including geotags; 

(j) All data and information that has been deleted by the user; 

(k) All past and present lists of friends created by the account; 

(l) All records of Instagram searches performed by the account; 

(m) The types of service utilized by the user; 

(n) The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

(o) All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

(p) All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

(q) All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and instrumentalities 
of violations of: 

Violation of National Firearms Act - Registration of Firearms, Title 26, United States Code, 
Section 5841. 

involving STEPHEN PADDOCK and others yet unidentified, including, for each user ID identified 
on Attachment “A,” information pertaining to the following matters: 

(a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 
accessories, ammunition, or explosives by Paddock, including through conspiring and 
cooperating to possess, use, purchase, or sell prohibited firearms, firearms 
accessories, ammunition, or explosives. 

(b) Evidence indicating how and when the Instagram account was accessed or used, to 
determine the chronological and geographic context of account access, use, and 
events relating to the crime under investigation and to the Facebook account owner; 

(c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 
crime under investigation; , 

(d) The identity of the person(s) who created or used the user ID, including records that 
help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ID about matters 
relating to the illegal possession, purchase, use, or sale of firearms, firearms 
accessories, ammunition, or explosives, including records that help reveal their 
whereabouts. 
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The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
separately sealed, as though set forth fully herein. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy 5 ). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section II. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 
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a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data fells within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section n. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part; 

(e) Issuing the Warrant 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or fee seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent wife fee warrant. The time for executing the warrant in Rule 41(e)(2)(A) and 
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1 (f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 

b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
I electronically stored information must be seized after the issuance of the warrant and copied 

after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41 (f)(1)(B), the inventory return that is to be filed with the court may be 

limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41 (f)( 1 )(B), the government may retain a copy of that information for purposes 

of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return of any 

information in the Search Warrant Data that is not set forth in Attachment B, Section II, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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SEALED 


Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 
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Attachment “Al” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs 
stephenpaddock47, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
September 1,2016 to present. 
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ATTACHMENT “B” 


Particular Things to be Seized 
I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is wi thin the possession, 
custody, or control of Instagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved pursuant 
to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1, 2016 to present: 

(a) All contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, Instagram 
passwords, Instagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other Instagram activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending “Friend” requests; 
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(f) All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

(g) All IP logs, including all records of the IP addresses that logged into the account; 

(h) All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

(i) All location data associated with the account, including geotags; 

(j) All data and information that has been deleted by the user; 

(k) All past and present lists of friends created by the account; 

(l) All records of Instagram searches performed by the account; 

(m) The types of service utilized by the user; 

(n) The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

(o) All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

(p) All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

(q) All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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n. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and instrumentalities 
of violations of: 

Violation of National Firearms Act- Registration of Firearms, Title 26, United States Code, 
Section 5841. 

involving STEPHEN PADDOCK and others yet unidentified, including, for each user ED identified 
on Attachment “A,” information pertaining to the following matters: 

(a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 
accessories, ammunition, or explosives by Paddock, including through conspiring and 
cooperating to possess, use, purchase, or sell prohibited firearms, firearms 
accessories, ammunition, or explosives. 

(b) Evidence indicating how and when the Instagram account was accessed or used, to 
determine the chronological and geographic context of account access, use, and 
events relating to the crime under investigation and to the Facebook account owner; 

(c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 
crime under investigation; 

(d) The identity of the person(s) who created or used the user ID, including records that 
help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ED about matters 
relating to the illegal possession, purchase, use, or sale of firearms, firearms 
accessories, ammunition, or explosives, including records that help reveal their 
whereabouts. 


The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
separately sealed, as though set forth fully herein. 
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ATTACHMENT C 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (The Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
mi n i m izing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy”). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section n. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section H as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 
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a. examination of all. of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents;. 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section H 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 
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(e) Issuing the Warrant. 
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(2) Contents of the Warrant. 
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(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant The time for executing the warrant in Rule 41(e)(2)(A) and 
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(f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41 (e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 

b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41 (f)(1)(B), the inventory return that is to be filed with the court may be 
limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41 (f)( 1 )(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return of any 
information in the Search Warrant Data that is not set forth in Attachment B, Section II, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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to search the subject premises for evidence and instrumentalities of the subject offenses, more 
fully described in Attachment “B” (attached hereto and incorporated herein by reference). 

BACKGROUND OF INVESTIGATION 

6. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music festival, 
was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At approximately 10:08 
p.m., the Las Vegas Metropolitan Police Department (LVMPD) received calls reporting shots 
had been fired at the concert and multiple victims were struck (the “attack”). LVMPD 
determined the shots were coming from Rooms 134 and 135 on the 32 nd floor of the Mandalay 
Bay Resort and Casino, located due west of the festival grounds at 3950 South Las Vegas 
Boulevard, Las Vegas, Nevada. These rooms are an elevated position which overlooks the 
concert venue. Witness statements and video footage captured during the attack indicates that 
the weapons being used were firing in a fully-automatic fashion. 

7. LVMPD officers ultimately made entry into the room and located an individual 
later identified as Stephen Paddock. Paddock was deceased from an apparent self-inflicted 
gunshot wound. 

8. Paddock's Nevada driver’s license was located in the Mandalay Bay hotel room 
with Paddock, and both hotel rooms were registered in his name.’ A player’s club card in name 
of Marilou Danley was located inPaddock’s room, and the card returned to the address located 
on Babbling Brook Court in Mesquite, Nevada. FBI Agents located Danley, who was traveling 
outside the United States at the time of the shooting. It was ultimately determined that Danley 
resided with Paddock at the Babbling Brook address. 

9. On October 2, 2017, local search warrants were obtained and executed on 
Paddock’s Mandalay Bay hotel rooms, Paddock’s vehicle parked in the Mandalay Bay parking 
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garage, and two Nevada residences owed by Paddock: 1372 Babbling Brook Court 1 , and 1735 Del 
Webb Parkway, Reno, Nevada. Pursuant to those searches. Officers and Agents found over 20 
firearms, hundreds of rounds of unfired ammunition (much of it in preloaded high-capacity 
magazines), range finding devices, several suitcases (some partially full of pre-loaded high 
capacity magazines) a set of body armor, an apparent homemade gas mask, and hundreds of 
spent cartridge cases in the Mandalay Bay hotel rooms, in close proximity to Paddock’s body. 
Over a thousand rounds of rifle ammunition and a significant amount of explosive precursor 
material was found in Paddock’s vehicle (specifically the binary explosive brand-named 
Tannerite). Additional explosive precursor material, approximately 18 firearms, and over 1,000 
rounds of ammunition were located at the Mesquite residence. A large quantity of ammunition 
and multiple firearms were recovered from the Reno residence. 

10. Immediately following the shooting, an extensive investigation was commenced 
which is currently being conducted jointly by LVMPD and the FBI, with the substantial support 
of numerous state, local and federal law enforcement agencies. As of this date, 58 people have 
been identified to have been killed in Paddock’s attack and over 500 were reportedly injured. 
The preliminary reviews of the crime scenes in and around the Mandalay Bay led investigators 
to determine that in addition to firing upon the crowds at the festival grounds. Paddock also 
fired several high-caliber rifle shots at large fuel tanks within the property line of the McCarran 
International airport property. Multiple bullet impacts were located on the tank, which 
investigators believe was an attempt by Paddock to explode the tanks. 

11. As the investigation progressed, investigators learned that Paddock planned the 
attack meticulously and took many methodical steps to avoid detection of his plot and to thwart 
the eventual law enforcement investigation that would follow. The steps included the apparent 


for this location was approved by 
I. A copy of that search warrant is attached hereto as Exhibit 1. 
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destruction and/or concealment of digital storage media and the use of anonymously attributed 
communications devices. Based on your Affiant’s training and experience, it is his belief that the 
methodical nature of the planning employed by Paddock, coupled with his efforts to undermine 
the preceding investigation, are factors indicative of a level of sophistication which is commonly 
found in mass casualty events such as this. However, your Affiant notes that this finding was 
not fully-developed in this case until several days into the investigation, after the subject 
premises had been searched in the hours immediately after the attack unfolded. 

12. The investigation has also revealed that Paddock may have been treated for yet 
unidentified medical conditions, and that he spent .significant time and expense prior to the 
attack purchasing and caching the weapons and other instrumentalities he used in the shooting. 
Some of these items included glass cutters, suitcases and a pre-paid cellular telephone. This 
cache included a substantial amount of ammunition, “Tannerite," 2 glass cutters, numerous 
suitcases, and at least one identified pre-paid cellular telephone. 

13. Investigators are currently conducting analysis of available financial records. To 
date, this analysis has revealed that Paddock made the purchases of items used in the attack 
throughout the last approximately 12 months. A large portion of the ammunition and firearms 
accessory purchases appear to have been made through Internet based retailers. Law 
enforcement continues to investigate the sourcing of purchases made by Paddock preceding the 
attack. 

Subsequent to her identification as Paddock’s companion and co-habitant at the 
subject premises, Marilou Danely returned to the United States and was thereafter voluntarily 
interviewed by law enforcement with her attorney present. During the interview, Danley 
corroborated much of what had been previously deduced by investigators, but she was adamant 


2 Tannerite is the brand name of a commercially available binary explosive commonly used as a reactive 
rifle target in shooting sports it can also be a precursor chemical for an improvised explosive devices. 
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that she had no prior inclination of Paddock intentions to conduct the attack. While investigators 
obtained a DNA buccal swab sample from Danley, she spontaneously stated that her fingerprints 
would likely be found on Paddock's ammunition because she occasionally participated in loading 
magazines. Danley has not been arrested and she has agreed to cooperate with investigators. 
Although, the investigation to date has not produced any conclusive evidence that Danley aided 
Paddock, had foreknowledge of his plans, or has been deceptive with law enforcement, this aspect 
of the investigation is still the subject of intensive review. Therefore, your Affiant asserts, for 
the purposes of this affidavit, that although there is currently no evidence to suggest criminal 
involvement by Danley, investigators are not yet prepared to rule this possibility out. 

15. Investigators have reviewed the findings of the initial search of the subject 
premises and have determined that an additional, more exhaustive search is required. The 
proposed search would be focused on finding items of evidence or instrumentalities that may 
have been concealed inside or within the curtilage of the subject premises. In addition, the 
search will include a more thorough effort to identify any forensic trace evidence that may be 
located inside or within the curtilage of the subject premises. 

PROBABLE CAUSE 

16. Your Affiant believes that probable cause exists for this Court to authorize the 
proposed search, and that this probable cause is relatively unchanged from the probable cause 
that existed in the hour after the attack when the initial search was conducted. Additionally, 
information received from Danley during her interview and further investigation of the crime 
scene, as well as a fuller understanding of Paddock’s mode of planning the attack, lead your 
Affiant to believe there is probable cause that additional evidence of the subject offenses may be 
located in the subject residence. 

17. The primary identified resident of the subject premises, Stephen Paddock, is 
deceased and as such, no longer holds standing at 1372 Babbling Brook Court. Investigators are 
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1 currently unable to determine Danley’s standing to provide consent to conduct this subsequent 

2 search. Therefore, although the FBI might already have all necessary authority to conduct the 

3 proposed search, your Affiant is seeking this search warrant out of an abundance of caution to 

4 be certain that any search conducted will comply with the Fourth Amendment and other 


applicable laws. 


CONCLUSION 


18. Based upon the aforementioned facts and circumstances, it is your Affiant’s 
opinion that there is probable cause that the subject premises may contain evidence and 
instrumentalities concerning violations of the subject offenses herein. Your Affiant’s training 
and experience provides the basis for his belief that a search of the subject premises will yield 
these items. As such, your Affiant seeks this Court's authorization to conduct a search of the 
subject premises as fully described in Attachment “A” for the items sought to be seized as 
described in Attachment "B.” 
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Attachment "A" 

Description of Propertv/Premise to be Searched 

1372 Babbling Brook Court 
Mesquite, Clark County, Nevada 

The subject premises is described as a one story, single family residence of apparent 
stucco frame construction. The premises are situated in the northeast corner Babbling Brook 
Court, which is a cul-de-sac. The premises faces approximately southwest and is located 
approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. 
The residence is painted tan and the house numbers “1372” are affixed to the exterior wall 
facing the street. 








Attachment "B 1 


Particular Items to be Seized 

a thorough, microscopic examination and documentation of the subject premises 
to discover trace evidence, including but not limited to: fingerprints, blood, hair, 
fibers and other bodily fluid samples; 

firearms to include handguns, shotguns and rifles, spent casings or live 
ammunition for the same, firearm accessories such as magazines or cylinders, 
firearm cleaning materials, and paperwork associated with the ownership of 
firearms; 


United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds, securities, 
cashier’s checks, money drafts, and letters of credit; 

books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories, 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 

books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and /or expenditure of money; 

any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives, explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 

any and all records relating to the medical or psychoiogical/psychiatric treatment 
of Stephen Paddock or Marilou Danley; 

all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 

cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, e-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists; 
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k. papers, tickets, notes, receipts, and other items relating to domestic and 
international travel. 

l. any and all electronic storage devices, including: computer hard drives and 
external memory devices such as floppy disks, “thumb drives” (USB electronic 
storage drives), and compact disk “CD” and/or “DVD” storage devices. 3 

m. records evidencing occupancy or ownership of the premises described above, 
including, but not limited to, utility and telephone bills, mail envelopes, or 
addressed correspondence; 

n. records or other items which evidence ownership or use of computer equipment 
found in the target location, including, but not limited to, sales receipts, bills for 
Internet access, and handwritten notes; 

o. any and all records pertaining to the rental of self-storage units and post office 
boxes; 

p. chemicals and other compounds which may constitute explosives or explosive 
precursors; and 

q. improvised, commercial or military grade explosive devices, detonators, initiators, 
any components thereof, or any other weapon of mass destruction. 
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3 Electronic equipment shall be seized, but not searched. Supplemental search warrant will be requested 
prior to the searching of seized electronic items. 
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AO 93 {Rev 1 !/l3) Search aivi Seizure Warrant 


United States District Court 

for the 

District of Nevada 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) j Case No 2:17-mj- 

1372 BABBLING BROOK COURT, ) 

MESQUITE. COUNTY OF CLARK.STATE OF NEVADA. ) 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of Nevada 

(identify the person or describe the property to he searched and give its location): 

SEE ATTACHMENT A 




I find that the affidavit(s). or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to he seized): 

SEE ATTACHMENTS B 


y6v ARE COMMANDED to execute this warrant on or beforeC C(Xi)X \ -JXm ( (not to exceed ! 4 days) 

in the daytime 6:00 a.m. to 10:00 p.m. G at any lime in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant or an officer present during the execution of the warrauL must prepare an inventory 
as required by law and promptly return this warrant and inventory' to ^ Y-t\>( _ 

• \fpmted Stales Mcfemratv Judge) 

O Pursuant to 18 U.S.C. § 3103a(b), i find that immediate notification may havrart adverse result listed in 18 U.S.C. 

$ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

n for days (not a> exceed30) !“J until, the facts justifying, the later specific dale of 

Dale and time issued: /->£'{ / L 

Citv and state: Las Vegas, Nevada 






^ ( Judge v signature 

\' \ -^y'x^c. y ^jc\A( V' ! c ,'t 

■ PiSnb'd dame and title ' • 




V 






Attachment "A' 


Description of Propertv/Premise to be Searched 

1372 Babbling Brook Court 
Mesquite, Clark County, Nevada 

The subject premises is described as a one story, single family residence of apparent 
stucco frame construction. The premises are situated in the northeast corner Babbling Brook 
Court, which is a cul-de-sac. The premises faces approximately southwest and is located 
approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. 
The residence is painted tan and the house numbers “1372” are affixed to the exterior wall 
facing the street. 








Attachment "B 1 


Particular Items to be Seized 

a thorough, microscopic examination and documentation of the subject premises 
to discover trace evidence, including but not limited to: fingerprints, blood, hair, 
fibers and other bodily fluid samples; 

firearms to include handguns, shotguns and rifles, spent casings or live 
ammunition for the same, firearm accessories such as magazines or cylinders, 
firearm cleaning materials, and paperwork associated with the ownership of 
firearms; 

United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds, securities, 
cashiers checks, money drafts, and letters of credit; 

books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories, 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 

books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and /or expenditure of money; 

any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives, explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 

any and all records relating to the medical or psychological/psychiatric treatment 
of Stephen Paddock or Marilou Danley; 

all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 

cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, e-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists; 
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k. papers, tickets, notes, receipts, and other items relating to domestic and 
international travel. 

l. any and all electronic storage devices, including: computer hard drives and 
external memory devices such as floppy disks, “thumb drives” (USB electronic 
storage drives), and compact disk “CD” and/or “DVD” storage devices.- 

m. records evidencing occupancy or ownership of the premises described above, 
including, but not limited to, utility and telephone bills, mail envelopes, or 
addressed correspondence; 

n. records or other items which evidence ownership or use of computer equipment 
found in the target location, including, but not limited to, sales receipts, bills for 
Internet access, and handwritten notes; 

o. any and all records pertaining to the rental of self-storage units and post office 
boxes; 

p. chemicals and other compounds which may constitute explosives or explosive 
precursors; and 

q. improvised, commercial or military grade explosive devices, detonators, initiators, 
any components thereof, or any other weapon of mass destruction. 


21 

22 

23 


24 

25 Electronic equipment shall be seized, but not searched. Supplemental search warrant will be requested 
prior to the searching of seized electronic items. 
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A() 93 (Rev 11/13) Search ai)d Seizure Warrant 


United States District Court 

for the 

District of Nevada 

In the Matter of the Search of 

{Briefly describe I he properly lo be searched 
nr identify the person hy name and address) 

1372 BABBLING BROOK COURT, 

MESQUITE. COUNTY OF CLARK.STATE OF NEVADA 

SEARCH AND SEIZURE WARRANT 

To: Any authorized iaw enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the District of Nevada 

(identify the person or describe the property to he searched and give its location): 

SEE ATTACHMENT A 


) Case No. 2:17-mj-^7 j-'' 


I find that the affidavit(s). or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the jierson or describe the property to he seized): 

SEE ATTACHMENTS B 


y<5t ARE COMMANDED to execute this warrant on or before^ cfc Yjf \ t / (not to exceed 14 days) 

t3 in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant or an officer present during the execution of the warrant, must prepare an inventor)' 

as required by law and promptly return this warrant and inventory lo Y-v., H _ 

^/Drifted States Mtfcmrate judge) 

H Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have-Wt adverse result listed in 18 U.S.C. 

$ 2705 (except for delay of trial), and authorize ihe officer executing this warrant to delay notice to the person who. or whose 
property, will be searched or seized (check the appropriate box) 

n for days (not to exceed 30) O until, ihe facts justifying, the later specific date of 


Date and time issued: 


Ciiv and state: 


: '/ Lc' H 


j-’- 


Las Vegas, Nevada 



T 
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Attachment "A" 

Description of Propertv/Premise to be Searched 

1372 Babbling Brook Court 
Mesquite, Clark County, Nevada 

The subject premises is described as a one story, single family residence of apparent 
stucco frame construction. The premises are situated in the northeast corner Babbling Brook 
Court, which is a cul-de-sac. The premises faces approximately southwest and is located 
approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. 
The residence is painted tan and the house numbers “1372" are affixed to the exterior wall 
facing the street. 
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Attachment "B” 

Particular Items to he Seized 

a thorough, microscopic examination and documentation of the subject premises 
to discover trace evidence, including but not limited to: fingerprints, blood, hair, 
fibers and other bodily fluid samples; 

firearms to include handguns, shotguns and rifles, spent casings or live 
ammunition for the same, firearm accessories such as magazines or cylinders, 
firearm cleaning materials, and paperwork associated with the ownership of 
firearms; 

United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds, securities, 
cashier’s checks, money drafts, and letters of credit; 

books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories, 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 

books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and /or expenditure of money; 

any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives, explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 

any and all records relating to the medical or psychological/psychiatric treatment 
of Stephen Paddock or Marilou Danley; 

all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 

cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, e-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists: 
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k. papers, tickets, notes, receipts, and other items relating to domestic and 
international travel. 

l. any and all electronic storage devices, including: computer hard drives and 
external memory devices such as floppy disks, “thumb drives” (USB electronic 
storage drives), and compact disk "CD” and/or “DVD” storage devices. 3 

m. records evidencing occupancy or ownership of the premises described above, 
including, but not limited to, utility and telephone bills, mail envelopes, or 
addressed correspondence; 

n. records or other items which evidence ownership or use of computer equipment 
found in the target location, including, but not limited to, sales receipts, bills for 
Internet access, and handwritten notes; 

o. any and all records pertaining to the rental of self-storage units and post office 
boxes; 

p. chemicals and other compounds which may constitute explosives or explosive 
precursors; and 

q. improvised, commercial or military grade explosive devices, detonators, initiators, 
any components thereof, or any other weapon of mass destruction. 


:i Electronic equipment shall be seized, but not searched. Supplemental search warrant will be requested 
prior to the searching of seized electronic items. 



STEVEN W. MYHKE 
Acting United States Attorney 
District of Nevada 
Cristina D. Silva 
Patrick Burns 

Assistant United States Attorneys 
501 Las Vegas Blvd. South, Ste. 1100 
Las Vegas, Nevada S9101 
Telephone: (702) 388-6336 
Fax (702) 388-6698 
CSilva@usa.doi.gov 
iohn.p.burns@usdoi.gov 

Representing the United Stales of America 


UNITED STATES DISTRICT COURT 
DISTRICT OF NEVADA 
-oOo- 


IN THE MATTER OF THE SEARCH OF: 

THE PREMISES KNOWN AS: 

1372 BABBLING BROOK COURT, 
MESQUITE, COUNTY OF CLARK, 
STATE OF NEVADA. 


Magistrate No. 


t?'-y c i 73 - fJ /< 


AFFIDAVIT IN SUPPORT OF 
SEARCH WARRANT 


(Under Seal) 


STATE OF NEVADA ) 

) ss: 

COUNTY OF CLARK ) 

AFFIDAVIT IN SUPPORT OF SEARCH WARRANT 

1. I, Christopher W. McPeak, Special Agent, Federal Bureau of Investigation (FBI), 
having been duly sworn, hereby depose and say: 

2. Your Affiant is a Special Agent with the FBI currently assigned to the Las Vegas, 
Nevada Division and has been so employed for over eight years. Prior to this he was employed 
for over five years as a Deputy Sheriff and Detective with the Orange County, Florida Sheriffs 
Office. As an FBI Agent, your Affiant is assigned to the FBI’s Las Vegas Safe Streets Task Force 
(LVSSTF) and is responsible for investigating a variety of violent crimes, to include bank 
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robbery, kidnapping, extortion, robbery, carjackings, assaults and murders of federal officers, 
racketeering related violent offenses, as well as long-term investigations into the activities and 
operations of career criminals, criminal enterprises, drug trafficking organizations, and violent 
street gangs. Your Affiant has experience in conducting criminal investigations, including the 
investigation of criminal groups and conspiracies as well as the collection of evidence and the 
identification and use of witnesses. 

3. The facts in this affidavit are derived from your Affiant’s personal observations, 
his training and experience, and information obtained from other agents, detectives, and 
witnesses. This affidavit is intended to show merely that there is sufficient probable cause for 
the requested warrant and does not set forth all of the Affiant’s knowledge about this matter. 

PREMISES TO BE SEARCHED 

4. The proposed search warrant seeks authorization to search the premises identified 
as 1372 Babbling Brook Court, Mesquite, Clark County, Nevada (hereinafter referred to as the 
“subject premises”), more fully described in Attachment “A” (attached hereto and incorporated 
herein by reference). 

I REQUEST FOR SEARCH WARRANT 

5. Based on your Affiant’s training and experience and the facts as set forth in this 
affidavit, there is probable cause to believe that violations of, inter alia: 

a. Destruction/Damage of Aircraft or Aircraft Facilities - 18 U.S.C. § 32(a); 

b. Violence at an International Airport - 18 U.S.C. § 37(a)(2); 

c. Unlawful Interstate Transport/Delivery of Firearms by NoD-Federal 
Firearms Licensee - 18 U.S.C. § 922(a)(3) and (5); and 

d. Aiding and Abetting - 18 U.S.C. § 2, 

(hereinafter referred to as the “subject offenses”) have been committed by Stephen Paddock and 
others yet unknown; and this affidavit is made in support of an application for a search warrant 
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AO 106 (Rev. 04/10) Application fora Search Warrant 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 

INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: Mariloudanley A2 


United States District Gomskn**«,& _ /Lj&i - 

that the foregoing document is a full true and correct 
for the copy of the original on file in my office, and in my legal 

District of Nevada custody. 

. CAM FERENBACH 
U.S. MAGISTRATE JUDGE 
DiSTniCT OF NEVADA 


Case No. By 2:17-mj-MQ 


_Omty 

Secret^- 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of peijury that I have reason to believe that on the following person or property ( identify the person or describe the 

AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: Mariloudanley 
A2 


located in the _ PEA _ District of ___, there is now concealed (identify the 

person or describe the property to be seised)'. 

INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: Mariloudanley 
A2 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
sf a person to be arrested or a person who is unlawfully restrained. 


03 

-< 


The search is related to a violation of: 

Code Section Offense Description 

Title 26, United States Code. Violation of National Firearms Act 
Section 5841. 



CD 

m 


CO 


The application is based on these facts: , .. , ... 

I believe there is probable cause to believe that in the subject accounts listed in Attachments A1 , A2 , A3 , 

"A4", "A5" there is proof that constitutes evidence of the commission of criminal offense(s); contraband, the fruits 
of crime and things otherwise criminally possessed and been used as the means of committing criminal offense(s) 


□ Continued on the attached sheet 

□ Delayed notice of ___ days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet 


-ML _ 

Applicant s signature 


Sworn to before me and signed in my presence. 
Date: /* "3 ~7‘) _ 


City and state: LaS 


Printed name and title 


CAM FERENBACH 

SiSfii 

U.S. MAGISTRATE JUDGE 

Printed name and title 





AO 93 {Rev. 11/13) Search and Seizure Warrant 


i I icicby dUcsl dirJ cwlify mi ; 




that the foregoing document is a full true and correct 

United States District g^R’! 9inal ° n 1,6 h my office ' and ,n «* 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

Mariloudanley A2 


for the 

District of Nevada 


) 

) 

) Case No. 

) 

) 

) 


By. 




CAM FERENBACH 
U.S. MAGfSTRATE JUDGE 
DISTRICT OF NEVADA 


/ De; 

-^Se. 


puty 
Secretary 


2:17-mj-00959-VCF 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of _ Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A2 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS B and C 


& 


YOU ARE COMMANDED to execute this warrant on or before 
in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


_ (not to exceed 14 days) 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ CAM FtzRENpA‘-»n _ 

• (United Stales Magistrate Judge) 


D Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _ 


Date and time issued: 


zici^n. 



City and state: Las Vegas, Nevada 


CAM FERENBACH 



U.S. MAGISTRATE JUDGE 


Printed name and title 





SEALED 


Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 
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Attachment M A2” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs mariloudanley, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 
headquartered in Menlo Park, California for the time period beginning September 1, 2016 to present. 
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ATTACHMENT “B” 

Particular Things to be Seized 
I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Instagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved purs uan t 
to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1, 2016 to present: 

(a) All contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, Instagram 
passwords, Instagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other Instagram activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending ‘Triend” requests; 
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(f) All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

(g) All IP logs, including all records of the IP addresses that logged into the account; 

(h) All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

(i) All location data associated with the account, including geotags; 

(j) All data and information that has been deleted by the user; 

(k) All past and present lists of friends created by the account; 

(l) All records of Instagram searches performed by the account; 

(m) The types of service utilized by the user; 

(n) The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

(o) All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

(p) All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

(q) All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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1 II. Information to be seized by the government 

2 All information described above in Section I that constitutes fruits, evidence, and instrumentalities 

3 of violations of: 

4 Violation of National Firearms Act - Registration of Firearms, Title 26, United States Code, 

5 Section 5841. 

6 involving STEPHEN PADDOCK and others yet unidentified, including, for each user ID identified 

7 on Attachment “A,” information pertaining to the following matters: 

8 (a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 

9 accessories, ammunition, or explosives by Paddock, including through conspiring and 

0 cooperating to possess, use, purchase, or sell prohibited firearms, firearms 

1 accessories, ammunition, or explosives. 

2 (b) Evidence indicating how and when the Instagram account was accessed or used, to 

3 determine the chronological and geographic context of account access, use, and 

4 events relating to the crime under investigation and to the Facebook account owner; 

5 (c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 

6 crime under investigation; 

7 (d) The identity of the person(s) who created or used the user ID, including records that 

8 help reveal the whereabouts of such person(s). 

9 (e) The identity of the person(s) who communicated with the user ID about matters 

0 relating to the illegal possession, purchase, use, or sale of firearms, firearms 

1 accessories, ammunition, or explosives, including records that help reveal their 

2 whereabouts. 


The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
24 separately sealed, as though set forth fully herein. 
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ATTACHMENT C 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy”). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section II. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document,- data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 
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a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h- performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section H. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant. The time for executing the warrant in Rule 41(e)(2)(A) and 
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(f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41 (e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 

b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court may be 
limi ted to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41 (f)(1)(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return of any 
information in the Search Warrant Data that is not set forth in Attachment B, Section H, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District 

for the f ore 9°' n 9 document is a full true and correct 

. copy of the original on file in my office, and in my legal 

Distri ct of Nevada custody. 


In the Matter of the Search of , 

(Briefly describe the property to be searched ) 

or identify the person by name and address) j 

INSTAGRAM ACCOUNTS STORED AT ) 

PREMISES CONTROLLED BY ) 

FACEBOOK CORPORATION: Mariloudanleyy A3 * > 


CAM FERENBACH 
U.S. MAGISTRATE JUDGE 
DISTRICT OF NEVADA 

Case No. 2:17-mj-00960-VCF 

J v -- r Deputy 

^.Secretary 




APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of penury that I have reason to believe that on the following person or property (identify the person or describe the 

P AT PREMISES CONTROLLED BY FACEBOOK CORPORATION’ 

Mariloudanleyy A3 


located in the 


DEA 


District of 


, there is now concealed (identify the 


person or describe the property to be seized)'. 

INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: Mariloudanleyy 

Aj 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
fif evidence of a crime; 

$T contraband, fruits of crime, or other items illegally possessed; 

^property designed for use, intended for use, or used in committing a crime; 
sf a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section Offense Description 

Title 26, United States Code, Violation of National Firearms Act 
Section 5841. 


The application is based on these facts: 

I believe there is probable cause to believe that in the subject accounts listed in Attachments "A1’, “A2", ‘A3’, 

“A4’, "A5" there is proof that constitutes evidence of the commission of criminal offense(s); contraband, the fruits 
of crime and things otherwise criminally possessed and been used as the means of committing criminal offense(s) 
□ Continued on the attached sheet. 

O Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 

_ IaI _ 

Applicant's signature 


Sworn to before me and signed in my presence. 


Date: 

City and state j, _as Vedas, Nevada 


Primed name and title 


CAM FERENBACH 


CANffMfTO 

U.S MAGISTRATE JUDGE 

Printed name and title 





AO 93 (Rev 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Nevada 


In the Matter of the Search of } 

(Hriejly describe the pro/xrty to he searched ) 

or identify the person hy name and address) ) 

1372 BABBLING BROOK COURT, ) 


MESQUITE. COUNTY OF CLARK.STATE OF NEVADA. ) 

) 


Case No. 2:17-mj- O.'-J Q j^-‘ 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the District of Nevada 

(identify the person or describe the property to he searched and give its location): 

SEE ATTACHMENT A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to he seized): 

SEE ATTACHMENTS B 




y<5u ARE COMMANDED to execute this warrant on or before (. chl'KX -JiG t ( (not to exceed! 4 days) 

in the daytime 6:00 a.m. to 10:00 p.m. D at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to .4 ?>( „ 

YfOmtcd States Maf’ijfrale Judge) 

O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may havesan adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
properly, will be searched or seized (check the appropriate box) 

fl for days (not to exceed 30) □ until, the facts justifying, the later specific date of 


Date and time issued: 
City and state: 




Attachment "A" 

Description of PropertWPremise to be Searched 


. 1372 Babbling Brook Court 

Mesquite, Clark County, Nevada 

The subject premises is described as a one story, single family residence of apparent 
stucco frame construction. The premises are situated in the northeast corner Babbling Brook 
Court, which is a cul-de-sac. The premises faces approximately southwest and is located 
approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. 
The residence is painted tan and the house numbers “1372” are affixed to the exterior wall 
facing the street. 
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Attachment "B" 

Particular Items to be Seized 

a thorough, microscopic examination and documentation of the subject premises 
to discover trace evidence, including but not limited to: fingerprints, blood, hair, 
fibers and other bodily fluid samples; 

firearms to include handguns, shotguns and rifles, spent casings or live 
ammunition for the same, firearm accessories such as magazines or cylinders, 
firearm cleaning materials, and paperwork associated with the ownership of 
firearms; 

United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds, securities, 
cashier's checks, money drafts, and letters of credit; 

books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories, 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 

books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and /or expenditure of money; 

any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives., explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 

any and all records relating to the medical or psychological/psychiatric treatment 
of Stephen Paddock or Marilou Danley; 

all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 

cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, e-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists; 
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k. papers, tickets, notes, receipts, and other items relating to domestic and 
international travel. 

l. any and all electronic storage devices, including: computer hard drives and 
external memory devices such as floppy disks, “thumb drives” (USB electronic 
storage drives), and compact disk “CD” and/or “DVD” storage devices. 3 

m. records evidencing occupancy or ownership of the premises described above, 
including, but not limited to, utility and telephone bills, mail envelopes, or 
addressed correspondence; 

n. records or other items which evidence ownership or use of computer equipment 
found in the target location, including, but not limited to, sales receipts, bills for 
Internet access, and handwritten notes; 

o. any and all records pertaining to the rental of self-storage units and post office 
boxes; 

p. chemicals and other compounds which may constitute explosives or explosive 
precursors; and 

q. improvised, commercial or military grade explosive devices, detonators, initiators, 
any components thereof, or any other weapon of mass destruction. 
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:i Electronic equipment shall be seized, but not searched. Supplemental search warrant will be requested 
prior to the searching of seized electronic items. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 




United States District Court wiocTn pun 

' ° ‘; j/: 


for the 

District of Nevada 


J o 

.. . JjOqp 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

EMAIL ACCOUNT CENTRALPARK1@LIVE.COM THAT ) 

IS STORED AT A PREMISES CONTROLLED BY ) 

MICROSOFT. A1 ) 


Case No. 2:17-mj-01009-NJK 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _____ District of _ Nevada 

identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT At 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
jescri bed above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS B and C 


ADU ARE COMMANDED to execute this warrant on or before OcAvt-e/ z~>, 1 (not lo exceed 14 days) 

0 in the daytime 6:00 a.m. to 10:00 pm □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ NANCY .1. KOPPF _• 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, wall be searched or seized (check the appropriate box) 

□ for_ days (not to exceed 30) □ until, the facts justifying, the later specific date of _. 


Date and time issued: { °l( JJi 


„ity and state: Las Vegas, Nevada 


;y a*** 


NANCY J. KOPPE 

Judge's signature 

u;;:niD states magistrate judge 

Printed name and title 


ATTACHMENT “A-l” 


ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
centralparkl@live.com (the ‘Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “B” 


Particular Things to be Seized 
I. Information to be disclosed bv the Service Provider 


To the extent that the information described in Attachments A1 and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-1 and A-2 from account inception to present: 

a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2 . 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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II. Information to be seized by the United States 

After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses”) that occur in the form of the following, from account inception to present: 

a. Communications, transactions and records that ma> 7 establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co- 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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AO 93 (Rev. 1 I/I 3) Search and Seizure Warrant 


United States District Court antn . 


for the 

District of Nevada 


r 0CTl * HI* 30 

. JUDQr 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) •j 

EMAIL ACCOUNT CENTRALPARK1@LIVE.COM THAT ) 
IS STORED AT A PREMISES CONTROLLED BY ) 

MICROSOFT. A1 ) 


Case No. 2:17-mj-01009-NJK 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of _ Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A1 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
Jescribed above, and that such search will reveal (identify the person or describe the property to be seized): 


SEE ATTACHMENTS B and C 


JYOU ARE COMMANDED to execute this warrant on or before OcMg/ z~i t -aoQ (not to exceed 14 days) 

0 in the daytime 6:00 a.m. to 1 0:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ NANCY .1 KOPPF _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

FJ for_days (not to exceed 30) O until, the facts j ustifying, the later specific date of _. 


Date and time issued: 


,ity and state: 


:30 f.*" 


Las Vegas, Nevada 


NANCY J. KOPPE 

Judge’s signature 

u:;;T£D states magistrate judge 


Printed name and title 
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ATTACHMENT “A-l” 


ONLINE ACCOUNT TO BE SEARCHED 
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This warrant applies to information associated with the Microsoft email account 
central parkl@live.com (the ‘Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “B” 



To the extent that the information described in Attachments Al and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-1 and A-2 from account inception to present: 

a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2. 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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After reviewing all information described in Section I, the United States will seize 


evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses ) that occur in the form of the following, from account inception to present: 


a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co- 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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1 

STEVEN W. MYHRE 


2 

Acting United States Attorney 

District of Nevada 

2317 OCT 13 PM 12:30 


CRISTINA D. SILVA 

U.S. H.v.VSV*: :r- r,.— 

3 

PATRICK BURNS 


o 

Assistant United States Attorneys 

r. •. # 

A 

501 Las Vegas Blvd. South, Ste. 1100 

" ■ -— 

4 

Las Vegas, Nevada 89101 

Telephone: (702) 388-6336 


5 
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AFFIDAVIT IN SUPPORT OF AN 


APPLICATION FOR SEARCH WARRANTS 

I, Zachary C. Mckinney, Special Agent, Federal Bureau of Investigation (FBI), 
having been duly sworn, hereby depose and say: 

INTRODUCTION AND AGENT BACKGROUND 

1* Your Affiant makes this affidavit in support of an application for search 
warrants for information associated with email accounts centralnark l@live.com (“Target 

8 Account 1”) and marilouroses@live.com (“Target Account 2”). Target Account 1 is an 

9 account associated with STEPHEN PADDOCK. Target Account 2 is an account 

10 associated with MARILOU DANLEY. The information associated with both accounts is 

11 stored at a premises owned, maintained, controlled, or operated by Microsoft 
Corporation (‘Microsoft), an American multinational technology company based in 

13 Redmond, Washington that specializes in Internet-related services and products along 

14 J with the development and manufacturing of computer-related items. Those online 

15 services include, but are not limited to, email services, cloud computing, and many other 

16 services. The information to be searched is described in the following paragraphs and in 
Attachment “A” (attached hereto and incorporated herein by reference). This affidavit is 

IS made in support of an application for search warrants under 18 U.S.C. §§ 2703(a), 
19 2703(b)(1)(A), and 2703(c)(1)(A) to require Microsoft to disclose to the government 

29 records and other information in its possession, pertaining to the subscriber or customer 
21 associated with the Target Accounts. 

2. I am a Special Agent with the Federal Bureau of Investigation, currently 
23 assigned to Las Vegas, Nevada. I have been employed as a Special Agent of the FBI since 
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March of 2017. Over the course of my employment with the FBI, I have conducted 
surveillance, analyzed telephone records, interviewed witnesses, supervised activities of 
sources, executed search warrants, and executed arrest warrants. These investigative 
activities have been conducted in conjunction with a variety of investigations, to include 
those involving robbery, drug trafficking, human trafficking, criminal enterprises, and 
more. In addition to my practical experiences, I received five months of extensive law 
enforcement training at the FBI Academy, Previous to the FBI, I was employed as a 
human intelligence gatherer with the United States Army. I was trained extensively in 
interrogation, interview, and source handling techniques and best practices. I also 
received an MBA in International Business and worked with ExxonMobil as a financial 
manager. 

3. I make this affidavit in support of an application for a search warrant for 
information associated with the Microsoft accounts associated with 
centralparkl@live.com” and “marilouroses@live.com,” which is stored at a premises 
owned, maintained, controlled, or operated by Microsoft Corporation, headquartered at 
One Microsoft Way, Redmond, WA 98052*6399, hereinafter referred to as “premises,” 
and further described in Attachments A-l and A-2 hereto. 

a. Destruction/Damage of Aircraft or Aircraft Facilities -18 U.S.C A. § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee — 18 U.S.C. §§ 922(a)(3) and (5); 

d. Aiding and Abetting — 18 U.S.C. § 2. 
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(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK, 
MARILOU DANLEY, and others yet unknown. There is also probable cause to search 
the information described in Attachment “A” for evidence of these crimes and 
information which might reveal the identities of others involved in these crimes, as 
described in Attachment “B” (attached hereto and incorporated herein by reference). 

PROBABLE CAUSE 

4. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

5. LVMPD officers ultimately made entry into the room and located an 
individual later identified as Stephen Paddock. Paddock was deceased from an apparent 
self-inflicted gunshot wound. 

6. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
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located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 

7. On October 2,2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms, Paddock’s vehicle at Mandalay Bay, and two Nevada residences owed 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammunition and 100 
pounds of explosive material was found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of ammunition was located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

8. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

9. In an effort to determine whether or not STEPHEN PADDOCK was 
assisted and/or conspired with unknown individuals, investigators have attempted to 
identify all of STEPHEN PADDOCK’S associated. It was quickly determined that a 
casino player’s card in the name of MARILOU DANLEY was located in the room at the 
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time of the attack. She has been identified thus far as the most likely person who aided 
or abetted STEPHEN PADDOCK based on her informing law enforcement that her 
fingerprints would likely be found on the ammunition used during the attack. 
Subsequently, investigators worked to identify the communication facilities utilized by 
STEPHEN PADDOCK and MARILOU DANLEY. 

10. Based on a review of STEPHEN PADDOCK's financial accounts, Target 
Account 1 was determined to belong to STEPHEN PADDOCK On October 3, 2017, 
investigators requested an emergency disclosure of records from Microsoft related to 
Target Account 1 so it could be immediately searched for any evidence of additional co¬ 
conspirators. Unfortunately, the information was only requested for a six-month 
timeframe. Within the account, investigators identified Target Account 2 as one that 
belonged to MARILOU DANLEY, which was clear based on the communications 
between the two email accounts. In an interview, DANLEY stated that PADDOCK had 
access to one of her email accounts, which investigators believe to be Target Account 2. 

11. On September 25, 2017, an email was exchanged between the Target 
Accounts which discussed a wire transfer of funds which was to be sent by STEPHEN 
PADDOCK to MARILOU DANLEY. It is unclear what the purpose of the wire transfer 
was, but MARILOU DANLEY is known to have been in the P hili ppines at the time. 

12. Additionally, on July 6, 2017, Target Account 1 sent an email to 
centralpark48Q4@Ermail.com which read, “try an ar before u buy. we have huge selection, 
located in the las vegas area ” Later that day, an email was received back from 
centralpark4804@gmail.com to Target Account 1 that read, “we have a wide variety of 
optics and ammunition to try." And lastly, Target Account 1 later sent an email to 
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centralpark4804@gmail-com that read, “for a thrill try out bumpfire ar’s with a 100 
round magazine.” Investigators believe these communications may have been related to 
the eventual attack that occurred at the Mandalay Bay in Las Vegas. 

13. Your Affiant believes the requested search warrants will yield sig nifi cant 
information from Microsoft such as STEPHEN PADDOCK's and MARILOU DANLEYs 
contact lists, email messages content, IP address usage, photographs, third-party 
applications associated with the account, and more, which may constitute evidence of 
the planning of the attack and potentially identify other participants in the attack. 
Ultimately, your Affiant strongly believes the requested information will lead 
investigators to determine the full scope of STEPHEN PADDOCK’s plan and MARILOU 
DANLEYs possible involvement. 

14. Investigators have previously sought and obtained a search warrant to 
examine the contents of both Target Accounts 1 and 2. After execution of that warrant, 
however, it became apparent and was confirmed with Microsoft that Microsoft was 
refusing to provide data related to/contained in the OneDrive o nlin e storage files for 
either account. Microsoft indicated to investigators that it did not believe such 
information was encompassed by the items to be produced that were specified in the 
original warrant. Investigators believe therefore that there is additional evidence 
Microsoft currently possesses that relates to the OneDrive online storage service, as well 
as potentially in a suite of other online services that Microsoft offers, including Office 
365, Windows Live Mail, Windows Live Writer, Windows Photo Gallery, Windows Live 
Messenger, Microsoft Family Safety, and Microsoft Outlook Hotmail Connector. Thus, 
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your Affiant seeks more specific authorization to seize and search the OneDrive and 
other service data specified in Attachment B of the instant warrant application. 

RELEVANT TECHNICAL TERMS 

15. The following non-exhaustive list of definitions applies to this Affidavit and 

the Attachments to this Affidavit: 

a. The “Internet” is a worldwide network of computer systems operated 
fay governmental entities, corporations, and universities. In order to access the Internet, 
an individual computer user must subscribe to an access provider, which operates a host 
computer system with direct access to the Internet. The World Wide Web is a 
functionality of the Internet which allows users of the Internet to share information. 

b. “Internet Service Providers” are companies that provide access to the 
Internet. ISPs can also provide other services for their customers including website 
hosting, email service, remote storage, and co-location of computers and other 
communications equipment. ISPs offer different ways to access the Internet including 
telephone-based (dial-up), broadband-based access via a digital subscriber line (DSL) or 
cable television, dedicated circuits, or satellite-based subscription. ISPs typically charge 
a fee based upon the type of connection and volume of data (bandwidth). Many ISPs 
assign each subscriber an account name, such as a user name, an email address, and an 
email mailbox, and the subscriber typically creates a password for his/her account. 

c. “ISP Records” are records maintained by ISPs pertaining to their 
subscribers (regardless of whether those subscribers are individuals or entities). These 
records may include account application information, subscriber and billing information, 
account access information (often in the form of log files), emails, information concerning 


8 
















1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


content uploaded and/or stored on the ISP’s servers, and other information, which may 
be stored both in computer data format and in written or planted record format. ISPs 
reserve and/or maintain computer disk storage space on their computer system for their 
subscribers’ use. This service by ISPs allows for both temporary and long-term storage 
of electronic communications and many other types of electronic data and files. 

d. “Online service providers” (also referred to here as “service 
providers”) are companies that provide online services such as email, chat or instant 
messaging, word processing applications, spreadsheet applications, presentation 
applications similar to PowerPoint, online calendar, photo storage and remote storage 
services. Sometimes they also can provide web hosting, remote storage, and co-location 
of computers and other communications equipment. Typically, each service provider 
assigns each subscriber an account name, such as a user name or screen name and the 

. subscriber typically creates a password for his/her account. 

e. “Computer,” as used herein, is defined as “an electronic, magnetic, 
optical, electrochemical, or other high speed data processing device performing logical or 
storage functions, and includes any data storage facility or communications facility 
directly related to or operating in conjunction with such device.” 

f. A “server” is a centralized computer that provides services for other 
computers connected to it via a network. The other computers attached to a server are 
sometimes called “clients.” For example, in a large company, it is common for individual 
employees to have client computers at their desktops. When the employees access their 
email, or access files stored on the network itself, those files are pulled electronically 
from the server, where they are stored, and are sent to the client’s computer via the 
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network. Notably, servers can be physically stored in any location: it is not uncommon 
for a network’s server to be located hundreds (and even thousands) of miles away from 
the client computers. 

g. Internet Protocol address,” or “IP address,” refers to a unique 
number used by a computer to access the Internet. IP addresses can be dynamic, 
meaning that the Internet Service Provider (ISP) assigns a different unique number to 
a computer every time it accesses the Internet. IP addresses might also be static, that 
is, an ISP assigns a user’s computer a particular IP address which is used each time the 
computer accesses the Internet. 

h. The term domain” refers to a word used as a name for computers, 
networks, services, etc. A domain name typically represents a website, a server computer 
that hosts that website, or even some computer (or other digital device) connected to the 
internet. Essentially, when a website (or a server computer that hosts that website) is 
connected to the internet, it is assigned an IP address. Because IP addresses are diffi cult 
for people to remember, domain names are instead used because they are easier to 
remember than IP addresses. Domain names are formed by the rules and procedures of 
the Domain Name System (DNS). A common top level domain under these rules is “.com” 
for commercial organizations, “.gov” for the United States government, and “.org” for 
organizations. For example, www.usdoi.gov is the domain name that identifies a server 
used by the U.S. Department of Justice, and which uses IP address of 149.101.46.71. 

i. “Web hosting services” maintain server computers connected to the 
Internet. Their customers use those computers to operate websites on the Internet. 
Customers of web hosting companies place files, software code, databases, and other data 
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on servers. To do this, customers typically connect from their own computers to the 
server computers across the Internet. 

j. The term “Whols” lookup refers to a search of a publicly available 
online database that lists information provided when a domain is registered or when an 
IP address is assigned. 

k. The terms “communications,” “records,” “documents,” “programs,” or 
“materials” include all information recorded in any form, visual or aural, and by any 
means, whether in handmade form (including, but not limited to, writings, drawings, 
paintings), photographic form (including, but not limited to, pictures or videos), or 
electrical, electronic or magnetic form, as well as digital data files. These terms also 
include any applications (i.e. software programs). These terms expressly include, among 
other things, emails, instant messages, chat logs, correspondence attached as to emails 
(or drafts), calendar entries, buddy lists. 

l. “Chat” is usually a real time electronic communication between two 
or more individuals. Unlike email, which is frequently sent, then read and responded to 
minutes, hours, or even days later, chats frequently involve an immediate conversation 
between individuals, similar to a face-to-face conversation. Nearly all chat programs are 
capable of saving the chat transcript, to enable users to preserve a record of the 
conversation. By default, some chat programs have this capability enabled, while others 
do not. Many popular web-based email providers, like Microsoft and Microsoft, provide 
chat functionality as part of the online services they provide to account holders. 

Ill 
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FACTS ABOUT EMAIL PROVIDERS 

16. In my training, my experience and this investigation, I have learned that 
Microsoft (the Service Provider) is a company that provides free web-based Internet 
email access to the general public, and that stored electronic communications, including 
opened and unopened email for Microsoft subscribers may be located on the computers 
of Microsoft. I have also learned that Microsoft Inc. provides various on-line service 
messaging services to the general public. Instant Messaging (“IM”) is a form of real-time 
direct text-based communication between two or more people using shared clients. The 
text is conveyed via devices connected over a network such as the Internet. In addition 
to text, Microsoft’s software allows users with the most current updated versions to 
utilize its webcam service. This option enables users from distances all over the world to 
view others who have installed a webcam on their end. Thus, the Service Provider’s 
servers will contain a wide variety of the subscriber’s files, including emails, address 
books, contact or buddy lists, calendar data, pictures, chat logs, and other files. 

17. To use these services, subscribers register for online accounts like the 
Target Accounts. During the registration process, service providers such as the ones here 
ask subscribers to provide basic personal information. This information can include the 
subscriber’s full name, physical address, telephone numbers and other identifiers, 
alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit card or bank account number). Based on my training and my 
experience, I know that subscribers may insert false information to conceal their 
identity; even if this proves to be the case, however, I know that this information often 
provide clues to their identity, location or illicit activities. 
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18. In general, when a subscriber receives an email, it is typically stored in the 
subscriber’s “mail box” on that service provider’s servers until the subscriber deletes the 
Email. If the subscriber does not delete the message, the message (and any attachments) 
can remain on that service provider’s servers indefinitely. 

19. . Similarly, when the subscriber sends an email, it is initiated at the 
subscriber’s computer, transferred via the Internet to' the service provider’s servers, and 
then transmitted to its end destination. That service provider often saves a copy of the 
email sent. Unless the sender of the email specifically deletes the Email from the 
provider’s server, the email can remain on the system inde fini tely. 

20. A sent or received email typically includes the content of the message, 
source and destination addresses, the date and time at which the email was sent, and 
the size and length of the email. If an email user writes a draft message but does not 
send it, that message may also be saved by that service provider, but may not include all 
of these categories of data. 

21. Just as a computer on a desk can be used to store a wide variety of files, so 
can online accounts, such as the accounts subject to this application. First, subscribers 
can store many types of files as attachments to emails in online accounts. Second, 
because service providers provide the services listed above (e.g. word processing, 
spreadsheets, pictures), subscribers who use these services usually store documents on 
servers maintained and/or owned by service providers. Thus, these online accounts often 
contain documents such as pictures, audio or video recordings, logs, spreadsheets, 
applications and other files. 
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22. Reviewing files stored in online accounts raises many of the same 
difficulties as with reviewing files stored on a local computer. For example, based on my 
training, my experience and this investigation, I know that subscribers of these online 
services can conceal their activities by altering files before they upload them to the online 
service. Subscribers can change file names to more innocuous sounding names (e.g. 
renaming “FraudRecords.doc” to “ChristmasList.doc”), they can change file extensions 
to make one kind of file appear like a different type of file (e.g. changing the spreadsheet 
“StolenCreditProfiles.xls” to “FamilyPhoto.jpg” to appear to be a picture file, where the 
file extension “.xls” denotes an Excel spreadsheet file and “.jpg” a JPEG format image 
file), or they can change the times and dates a file was last accessed or modified by 
changing a computer’s system time/date and then uploading that file to the Online 
Accounts. Thus, to detect any files that the subscriber may have concealed, agents will 
need to review all of the files in the Target Accounts; they will, however, only seize the 
items that the Court authorizes to be seized. Similarly, subscribers can conceal their 
activities by encrypting files. Thus, these files may need to be decrypted to detect 
whether it constitutes an Item to be Seized. 

23. I also believe that people engaged in crimes such as the one described 
herein often use online accounts because they give people engaged in these crimes a way 
to easily communicate with other co-conspirators. Moreover, online accounts are easily 
concealed from law enforcement. Unlike physical documents, electronic documents can 
be stored in a physical place far away, where they are less likely to be discovered. 

24. Service providers typically retain certain transactional information about 
the creation and use of each account on their systems. This information can include the 
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date on which the account was created, the length of service, records of log-in (i.e., 
session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the 
account (such as logging into the account via websites controlled by the Service 
Provider), and other log files that reflect usage of the account- In addition, service 
providers often have records of the Internet Protocol address (“IP address”) used to 
register the account and the IP addresses associated with particular logins to the 
account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to 
access the online account. 

25. In some cases, subscribers will communicate directly with a service 
provider about issues relating to the account, such as technical problems, billing 
inquiries, or complaints from or about other users. Service providers typically retain 
records about such communications, including records of contacts between the user and 
the provider’s support services, as well records of any actions taken by the provider or 
user as a result of the communications. 

26. In my training and experience, evidence of who was using an online account 
may be found in address books, contact or buddy lists, emails in the account, and pictures 
and files, whether stored as attachments or in the suite of the service provider’s online 
applications. Therefore, the computers of the Service Providers are likely to contain 
stored electronic communications (including retrieved and un-retrieved email for their 
subscribers) and information concerning subscribers and their use of the provider’s 
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services, such as account access information, email transaction information, documents, 
pictures, and account application information. 

27. Microsoft maintains and offers its users the use of OneDrive. OneDrive is 
a file-hosting service operated by Microsoft as part of its suite of online services. It allows 
users to store files as well as other personal data like Windows settings or BitLocker 
recovery keys in the cloud. Files can be synced to a PC and accessed from a web browser 
or a mobile device, as well as shared publicly or with specific people. OneDrive offers 5 
gigabytes of storage space free of charge; additional storage can be added either 
separately or through subscriptions to other Microsoft services including Office 365 and 
Groove Music. 

28. Microsoft offers additional services that may be accessed in relation to and 
share associated information with a user’s email account, including: Office 365, Windows 
Live Mail, Windows Live Writer, Windows Photo Gallery, Windows Live Messenger, 
Microsoft Family Safety, and Microsoft Outlook Hotmail Connector. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

29. Your Affiant anticipates executing these warrants under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Microsoft to disclose to the government 
copies of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “B.” Upon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items described in Section II of Attachment “B.” 
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CONCLUSION 

30. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is u a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 


31. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 
the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
cause, to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 


Respectfully Submitted, 


Zachary C. McKinney, Special Agent 
Federal Bureau of Investigation 


SWORN TO AND SUBSCRIBED 
before me this day of October 2017. 


NANCY J. KOPPE 


UNITED STATES MAGISTRATE JUDGE 
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NANCY J. KOPPE 
U ‘S- MAGISTRATE JUDGE 
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ATTACHMENT “A-l” 

ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
centr alp ark l@Uve.com (the “Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Was hin gton, 98052. 
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ATTACHMENT “A-2” 

ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
marilouroses@Iive.com (the ‘Target Account 2”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “B” 



To the extent that the information, described in Attachments Al and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(1), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-l and A-2 from account inception to present: 

a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2. 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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Information to be seized by the United States 


After reviewing all information described in Section X, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses”) that occur in the form of the following, from account inception to present: 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 


21 









1 


ATTACHMENT “C” 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 


PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy’). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 
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4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive .list, as other search procedures may be used): 

a. exa mi nation of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A1 and A2; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 


23 










1 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or. the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AFFIDAVIT IN SUPPORT O 


APPLICATION FOR SEARCH WARRANTS 


I, Zachary C. Mckinney, Special Agent, Federal Bureau of Investigation (FBI), 
having been duly sworn, hereby depose and say: 

INTRODUCTION AND AGENT BACKGROUND 


1. Your Affiant makes this affidavit in support of an application for search 
warrants for information associated with email accounts centralnark l@live.com (“Target 
Account 1”) and marilouroses@live.com (“Target Account 2”). Target Account 1 is an 
9 II account associated with STEPHEN PADDOCK Target Account 2 is an account 

10 associated with MARILOU DANLEY. The information associated with both accounts is 

11 stored at a premises owned, maintained, controlled, or operated by Microsoft 

12 Corporation (“Microsoft”), an American multinational technology company based in 

1 3 A Redmond, Washington that specializes in Internet-related services and products along 

14 I with the development and manufacturing of computer-related items. Those online 
1^ services include, but are not limited to, email services, cloud computing, and many other 
13 I services. The information to be searched is described in the following paragraphs and in 

Attachment “A” (attached hereto and incorporated herein by reference). This affidavit is 
|| made in support of an application for search warrants under 18 U.S.C. §§ 2703(a), 

19 I 2703(b)(1)(A), and 2703(c)(1)(A) to require Microsoft to disclose to the government 

20 records and other information in its possession, pertaining to the subscriber or customer 

21 associated with the Target Accounts. 

22 2. I am a Special Agent with the Federal Bureau of Investigation, currently 

23 assigned to Las Vegas, Nevada. I have been employed as a Special Agent of the FBI since 
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March of 2017. Over the course of my employment with the FBI, I have conducted 
surveillance, analyzed telephone records, interviewed witnesses, supervised activities of 
sources, executed search warrants, and executed arrest warrants. These investigative 
activities have been conducted in conjunction with a variety of investigations, to include 
those involving robbery, drug trafficking, human trafficking, criminal enterprises, and 
more. In addition to my practical experiences, I received five months of extensive law 
enforcement training at the FBI Academy. Previous to the FBI, I was employed as a 
human intelligence gatherer with the United States Army. I was trained extensively in 
interrogation, interview, and source hand l i n g techniques and best practices. I also 
received an MBA in International Business and worked with ExxonMobil as a financial 
manager. 

3. I make this affidavit in support of an application for a search warrant for 
information associated with the Microsoft accounts associated with 
centralparkl@live.com” and “marilouroses@live.com,” which is stored at a premises 
owned, maintained, controlled, or operated by Microsoft Corporation, headquartered at 
One Microsoft Way, Redmond, WA 98052-6399, hereinafter referred to as “premises,” 
and further described in Attachments A-1 and A-2 hereto. 

a. Destruction/Damage of Aircraft or Aircraft Facilities - 18 U.S.CA.. § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee - 18 U.S.C. §§ 922(a)(3) and (5); 

d. Aiding and Abetting — 18 U.S.C. § 2. 
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(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK, 
MARILOU DANLEY, and others yet unkn own. There is also probable cause to search 
the information described in Attachment “A” for evidence of these crimes and 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


information which might reveal the identities of others involved in these crimes, as 
described in Attachment “B” (attached hereto and incorporated herein by reference). 

PROBABLE CAUSE 

4. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

5. LVMPD officers ultimately made entry into the room and located an 
individual later identified as Stephen Paddock. Paddock was deceased from an apparent 
self-inflicted gunshot wound. 

6. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
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located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 

7. On October 2, 2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms, Paddock’s vehicle at Mandalay Bay, and two Nevada residences owed 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammunition and 100 
pounds of explosive material was found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of ammunition was located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

8. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

9. In an effort to determine whether or not STEPHEN PADDOCK was 
assisted and/or conspired with unknown individuals, investigators have attempted to 
identify all of STEPHEN PADDOCK’s associated. It was quickly determined that a 
casino player’s card in the name of MARILOU DANLEY was located in the room at the i 
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time of the attack. She has been identified thus far as the most likely person who aided 
or abetted STEPHEN PADDOCK based on her informing law enforcement that her 
fingerprints would likely be found on the ammunition used during the attack. 
Subsequently, investigators worked to identify the communication facilities utilized by 
STEPHEN PADDOCK and MARILOU DANLEY. 

10. Based on a review of STEPHEN PADDOCKs financial accounts, Target 
Account 1 was determined to belong to STEPHEN PADDOCK On October 3, 2017, 
investigators requested an emergency disclosure of records from Microsoft related to 
Target Account 1 so it could be immediately searched for any evidence of additional co- 
conspirators. Unfortunately, the information was only requested for a six-month 
timeframe. Within the account, investigators identified Target Account 2 as one that 
belonged to MARILOU DANLEY, which was clear based on the communications 
between the two email accounts. In an interview, DANLEY stated that PADDOCK had 
access to one of her email accounts, which investigators believe to be Target Account 2. 

11. On September 25, 2017, an email was exchanged between the Target 
Accounts which discussed a wire transfer of funds which was to be sent by STEPHEN 
PADDOCK to MARILOU DANLEY. It is unclear what the purpose of the wire transfer 
was, but MARILOU DANLEY is known to have been in the Philippines at the time. 

12. Additionally, on July 6, 2017, Target Account 1 sent an email to 
centralDark4804@gmail.com which read, “try an ar before u buy. we have huge selection, 
located in the las vegas area” Later that day, an email was received back from 
centralpark4804@gmail.com to Target Account 1 that read, “we have a wide variety of 
optics and ammunition to try.” And lastly, Target Account 1 later sent an email to 
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contact lists, email messages content, IP address usage, photographs, third-party 
applications associated with the account, and more, which may constitute evidence of 
the planning of the attack and potentially identify other participants in the attack. 
Ultimately, your Affiant strongly believes the requested information will lead 
investigators to determine the full scope of STEPHEN PADDOCK’S plan and MARILOU 
OAKLEY’S possible involvement. 

14. Investigators have previously sought and obtained a search warrant to 
examine the contents of both Target Accounts 1 and 2. After execution of that warrant, 
however, it became apparent and was confirmed with Microsoft that Microsoft was 
refusing to provide data related to/contained in the OneDrive online storage files for 
either account. Microsoft indicated to investigators that it did not believe such 
information was encompassed by the items to be produced that were specified in the 
original warrant. Investigators believe therefore that there is additional evidence 
Microsoft currently possesses that relates to the OneDrive online storage service, as well 
as potentially in a suite of other online services that Microsoft offers, including Office 
365, Windows Live Mail, Windows Live Writer, Windows Photo Gallery, Windows Live 
Messenger, Microsoft Family Safety, and Microsoft Outlook Hotmail Connector. Thus, 
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your Affiant seeks more specific authorization to seize and search the OneDrive and 
other sendee data specified in Attachment B of the instant warrant application. 

RELEVANT TECHNICAL TERMS 

15. The following non-exhaustive list of definitions applies to this Affidavit and 
the Attachments to this Affidavit: 

a. The “Internet” is a worldwide network of computer systems operated 
by governmental entities, corporations, and universities. In order to access the Internet, 
an individual computer user must subscribe to an access provider, which operates a host 
computer system with direct access to the Internet. The World Wide Web is a 
functionality of the Internet which allows users of the Internet to share information. 

b. “Internet Service Providers” are companies that provide access to the 
Internet. ISPs can also provide other services for their customers including website 
hosting, email service, remote storage, and co-location of computers and other 
communications equipment. ISPs offer different ways to access the Internet including 
telephone-based (dial-up), broadband-based access via a digital subscriber line (DSL) or 
cable television, dedicated circuits, or satellite-based subscription. ISPs typically charge 
a fee based upon the type of connection and volume of data (bandwidth). Many ISPs 
assign each subscriber an account name, such as a user name, an email address, and an 
email mailbox, and the subscriber typically creates a password for his/her account. 

c. “ISP Records” are records maintained by ISPs pertaining to their 
subscribers (regardless of whether those subscribers are individuals or entities). These 
records may include account application information, subscriber and billing information, 
account access information (often in the form of log files), emails, information concerning 
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content uploaded and/or stored on the ISP’s servers, and other information, which may 
be stored both in computer data format and in written or printed record format- ISPs 
reserve and/or maintain computer disk storage space on their computer system for their 
subscribers’ use. This service by ISPs allows for both temporary and long-term storage 
of electronic communications and many other types of electronic data and files. 

d. “Online service providers” (also referred to here as “service 
providers”) are companies that provide online services such as email, chat or instant 
messaging, word processing applications, spreadsheet applications, presentation 
applications similar to PowerPoint, online calendar, photo storage and remote storage 
services. Sometimes they also can provide web hosting, remote storage, and co-location 
of computers and other communications equipment. Typically, each service provider 
assigns each subscriber an account name, such as a user name or screen name and the 
subscriber typically creates a password for his/her account. 

e. “Computer,” as used herein, is defined as “an electronic, magnetic, 
optical, electrochemical, or other high speed data processing device performing logical or 
storage functions, and includes any data storage facility or communications facility 
directly related to or operating in conjunction with such device.” 

f. A “server” is a centralized computer that provides services for other 
computers connected to it via a network. The other computers attached to a server are 
sometimes called “clients ” For example, in a large company, it is common for individual 
employees to have client computers at their desktops. When the employees access their 
email, or access files stored on the network itself, those files are pulled electronically 
from the server, where they are stored, and are sent to the client’s computer via the 


9 











1 network. Notably, servers can be physically stored in any location: it is not uncommon 

2 for a network’s server to be located hundreds (and even thousands) of miles away from 

3 the client computers. 

g. “Internet Protocol address,” or “IP address,” refers to a unique 
number used by a computer to access the Internet. IP addresses can be dynamic, 
meaning that the Internet Service Provider (ISP) assigns a different unique number to 
a computer every time it accesses the Internet. IP addresses might also be static, that 
is, an ISP assigns a user’s computer a particular IP address which is used each time the 
computer accesses the Internet. 

h. The term “domain” refers to a word used as a name for computers, 
networks, services, etc. A domain name typically represents a website, a server computer 


12 | that hosts that website, or even some computer (or other digital device) connected to the 
internet. Essentially, when a website (or a server computer that hosts that website) is 
connected to the internet, it is assigned an IP address. Because IP addresses are difficult 
for people to remember, domain names are instead used because they are easier to 
remember than IP addresses. Domain names are formed by the rules and procedures of 
the Domain Name System (DNS). A common top level domain under these rules is “.com” 
for commercial organizations, “.gov” for the United States, government, and “.org” for 
organizations. For example, www.usdoi.gov is the domain name that identifies a server 
used by the U.S. Department of Justice, and which uses IP address of 149.101.46.71. 

i. “Web hosting services” maintain server computers connected to the 
Internet. Their customers use those computers to operate websites on the Internet. 
Customers of web hosting companies place files, software code, databases, and other data 
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on servers. To do this, customers typically connect from their own computers to the 
server computers across the Internet. 

j. The term “Whols” lookup refers to a search of a publicly available 
online database that lists information provided when a domain is registered or when an 
IP address is assigned. 

k. The terms “communications,” “records,” “documents,” “programs,” or 
“materials” include all information recorded in any form, visual or aural, and by any 
means, whether in handmade form (including, but not limited to, writings, drawings, 
paintings), photographic form (including, but not limited to, pictures or videos), or 
electrical, electronic or magnetic form, as well as digital data files. These terms also 
include any applications (i.e. software programs). These terms expressly include, among 
other things, emails, instant messages, chat logs, correspondence attached as to emails 
(or drafts), calendar entries, buddy lists. 

l. “Chat” is usually a real time electronic communication between two 
or more individuals. Unlike email, which is frequently sent, then read and responded to 
minutes, hours, or even days later, chats frequently involve an imm ediate conversation 
between individuals, similar to a face-to-face conversation. Nearly all chat programs are 
capable of saving the chat transcript, to enable users to preserve a record of the 
conversation. By default, some chat programs have this capability enabled, while others 
do not. Many popular web-based email providers, like Microsoft and Microsoft, provide 
chat functionality as part of the online services they provide to account holders. 

Ill 

III 
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FACTS ABOUT EMAIL PROVIDERS 

16. In my training, my experience and this investigation, I have learned that 
Microsoft; (the Service Provider) is a company that provides free web-based Internet 
email access to the general public, and that stored electronic communications, including 
opened and unopened email for Microsoft subscribers may be located on the computers 
of Microsoft. I have also learned that Microsoft Inc. provides various on-line service 
messaging services to the general public. Instant Messaging (“IM”) is a form of real-time 
direct text-based communication between two or more people using shared clients. The 
text is conveyed via devices connected over a network such as the Internet. In addition 
to text, Microsoft’s software allows, users with the most current updated versions to 
utilize its webcam service. This option enables users from distances all over the world to 
view others who have installed a webcam on their end. Thus, the Service Provider’s 
servers will contain a wide variety of the subscriber’s files, including emails, address 
books, contact or buddy lists, calendar data, pictures, chat logs, and other files. 

17. To use these services, subscribers register for online accounts like the 
Target Accounts. During the registration process, service providers such as the ones here 
ask subscribers to provide basic personal information. This information can include the 
subscriber’s full name, physical address, telephone numbers and other identifiers, 
alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit card or bank account number). Based on my training and my 
experience, I know that subscribers may insert false information to conceal their 
identity; even if this proves to be the case, however, I know that this information often 
provide clues to their identity, location or illicit activities. 
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18. In general, when a subscriber receives an email, it is typically stored in the 
subscriber’s “mail box” on that service provider’s servers until the subscriber deletes the 
Email. If the subscriber does not delete the message, the message (and any attachments) 
can remain on that service provider’s servers indefinitely. 

19. Similarly, when the subscriber sends an email, it is initiated at the 
subscriber’s computer, transferred via the Internet to the service provider’s servers, and 
then transmitted to its end destination. That service provider often saves a copy of the 
email sent. Unless the sender of the email specifically deletes the Email from the 
provider’s server, the email can remain on the system indefinitely. 

20. A sent or received email typically includes the content of the message, 
source and destination addresses, the date and time at which the email was sent, and 
the size and length of the email. If an email user writes a draft message but does not 
send it, that message may also be saved by that service provider, but may not include all 
of these categories of data. 

21. Just as a computer on a desk can be used to store a wide variety of files, so 
can online accounts, such as the accounts subject to this application. First, subscribers 
can store many types of files as attachments to emails in online accounts. Second, 
because service providers provide the services listed above (e.g. word processing, 
spreadsheets, pictures), subscribers who use these services usually store documents on 
servers maintained and/or owned by service providers. Thus, these online accounts often 
contain documents such as pictures, audio or video recordings, logs, spreadsheets, 
applications and other files. 
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22. Reviewing files stored in online accounts raises many of the same 
difficulties as with reviewing files stored on a local computer. For example, based on my 
training, my experience and this investigation, X know that subscribers of these online 
services can conceal their activities by altering files before they upload them to the online 
service. Subscribers can change file names to more innocuous sounding names (e.g. 
renaming “FraudRecords.doc” to “ChristmasList.doc”), they can change file extensions 
to make one kind of file appear like a different type of file (e.g. changing the spreadsheet 
“StolenCreditProfiles.xls” to “FamilyPhoto.jpg” to appear to be a picture file, where the 
file extension “.xls” denotes an Excel spreadsheet file and “.jpg” a JPEG format image 
file), or they can change the times and dates a file was last accessed or modified by 
changing a computer’s system time/date and then uploading that file to the Online 
Accounts. Thus, to detect any files that the subscriber may have concealed, agents will 
need to review all of the files in the Target Accounts; they will, however, only seize the 
items that the Court authorizes to be seized. Similarly, subscribers can conceal their 
activities by encrypting files. Thus, these files may need to be decrypted to detect 
whether it constitutes an Item to be Seized. 

23. I also believe that people engaged in crimes such as the one described 
herein often use online accounts because they give people engaged in these crimes a way 
to easily communicate with other co-conspirators. Moreover, online accounts are easily 
concealed from law enforcement. Unlike physical documents, electronic documents can 
be stored in a physical place far away, where they axe less likely to be discovered. 

24. Service providers typically retain certain transactional information about 
the creation and use of each account on their systems. This information can include the 
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date on which the account was created, the length of service, records of log*in (i.e., 
session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the 
account (such as logging into the account via websites controlled by the Service 
Provider), and other log files that reflect usage of the account. In addition, service 
providers often have records of the Internet Protocol address (“IP address”) used to 
register the account and the IP addresses associated with particular logins to the 
account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to 
access the online account. 

25. In some cases, subscribers will communicate directly with a service 
provider about issues relating to the account, such as technical problems, billing 
inquiries, or complaints from or about other users. Service providers typically retain 
records about such communications, including records of contacts between the user and 
the provider’s support services, as well records of any actions taken by the provider or 
user as a result of the communications. 

26. In my training and experience, evidence of who was using an online account 
may be found in address books, contact or buddy lists, emails in the account, and pictures 
and files, whether stored as attachments or in the suite of the service provider’s online 
applications. Therefore, the computers of the Service Providers are likely to contain 
stored electronic communications (including retrieved and un-retrieved email for their 
subscribers) and information concerning subscribers and their use of the provider’s 
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services, such as account access information, email transaction information, documents, 
pictures, and account application information. 

27. Microsoft maintains and offers its users the use of OneDrive. OneDrive is 
a file-hosting service operated by Microsoft as part of its suite of o nlin e services. It allows 
users to store files as well as other personal data like Windows settings or BitLocker 
recovery keys in the cloud. Files can be synced to a PC and accessed from a web browser 
or a mobile device, as well as shared publicly or with specific people. OneDrive offers 5 
gigabytes of storage space free of charge; additional storage can be added either 
separately or through subscriptions to other Microsoft services including Office 365 and 
Groove Music. 

28. Microsoft offers additional services that may be accessed in relation to and 
share associated information with a user’s email account, including: Office 365, Windows 
Live Mail, Windows Live Writer, Windows Photo Gallery, Windows Live Messenger, 
Microsoft Family Safety, and Microsoft Outlook Hotmail Connector. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

29. Your Affiant anticipates executing these warrants under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Microsoft to disclose to the government 
copies of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “B.” Upon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items described in Section II of Attachment “B.” 
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CONCLUSION 


30. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated ” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 

REQUEST FOR SEALING 

31. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 


the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
cause to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 


Respectfully Submitted, 


Zachary C. McKinney, Special Agent 
Federal Bureau of Investigation 


SWORN TO ANI^gUBSCRIBED 
before me this L5. day of October 2017. 


_ NANCY J. KOPPE _ 

UNITED STATES MAGISTRATE JUDGE 


[ hereby attest and certify on. \ohi/m 
that the foregoing document is a full tote and correct 
copy of the original on file in my office, and in my leqal 
custody. 

NANCY J. KOPPE 
U.S. MAGISTRATE JUDGE 
. _ / DISTRICT OF NEVADA 
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ATTACHMENT “A-l” 

ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
centralparkl@live.com (the ‘Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “A-2” 


ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
m 9 nlouroses@live.com (the “Target Account 2”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Kedmond, Washington, 98052. 
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ATTACHMENT “B” 



To the extent that the information described in Attachments A1 and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-l and A-2 from account inception to present: 

a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2. 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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After reviewing all information described in Section I, the United States will seize 


evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transporfc/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses”) that occur in the form of the following, from account inception to present: 


a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co- 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to" the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and ail methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy w'ill be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

£ scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A1 and A2; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in' 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution ; 

of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 


b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time wit hin 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AO 93 {Rev 11/13) Search and Seizufe Warrant 


United States District Court 

for the 

District of Nevada 

In the Matter of the Search of 

(Briefly describe the properly to be searched 
or identify the person by name and address) 

ACCOUNT(S) ASSOCIATED WITH THE CELLULAR 
DEVICE BEARING IMEI 990006880858377 STORED 
AT A PREMISES CONTROLLED BY GOOGLE 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the___District of _ Nevada 

Cidenlify the person or describe the property to be searched and give its location)'. 

SEE ATTACHMENT A 


) 

) 

) Case No. 2:17 ‘ m j- ^‘7/ - 

) 

) 


1 find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 

described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS B and C 


YOU ARE COMMANDED to execute this warrant on or before (not to exceed 14 days) 

3\n the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, mpst prepare an inventory 

as required by law and promptly return this warrant and inventory to _ / /^y\tX-^\ ~ \ -• 

(United States Magistrate Judge) 

rj Pursuant to 18 U.S.C. § 3103a(b), 1 find that immediate notification may have an adVerse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30j D until, the facts justifying, the later specific date of_. 


Date and time issued: 


City and stale: 



Las Vegas, Nevada 
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ATTACHMENT “A” 


ONLINE ACCOUNT TO BE SEARCHED 

1- This warrant applies to information related to the Google account 
associated with the cellular device bearing IMEI 990006880858377 (the “Target 
Account”) from its inception to present, which is stored at premises owned, maintained, 
controlled, or operated by Google, Inc., headquartered at 1600 Amphitheatre Way, 
Mountain View, California, 94043. 
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ATTACHMENT “B” 

Particular Things to be Seized 

I. Information to be disclosed bv the Service Provider 

To the extent that the information described in Attachment A is within the 
possession, custody, or control of Google, including any Emails, records, files, logs, or 
information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 

a. The contents of all messages and emails associated with the account, 
including copies of messages and emails sent to and from the account, draft 
messages/emails, the source and destination addresses associated with 
each message/email, the date and time at which each message/email was 
sent, and the size and length of each message/email; 

b. All records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other 
identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means 
and source of payment (including any credit or bank account number); 

c. All records or other information stored in the Online Accounts, including 
address books, contact and buddy lists, calendar data, pictures, 
applications, documents, and other files; 

d. All records pertaining to communications between Service Provider and 
any person regarding the account, including contacts with support services 
and records of actions taken. 

e. All data and contents related to the following Google Services associated 
with the Target Account: Android; Gmail; Google Calendar; Google Docs; 
Google Drive; Google Talk; Multilogin; Web History; YouTube; and all other 
applications. 

f. All information and content associated with any third-party application 
associated with the Target Account and the dates when the applications 
were installed; 
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g. Based on an analysis of cookies assigned to computers and devices that 
accessed the Target Account, identify all other Google accounts that have 
been accessed from any computers and devices that have logged into the 
Target Account. 

II. Information to be seized bv the United States 

After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present; 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy fists. 
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ATTACHMENT “C” 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data fisted as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 


a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 
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b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 
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c. surveying various file directories and the individual files they contain; 
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d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 
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(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be. copied onto appropriate media and returned to the 
person from whom the information was seized. 
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STEVEN W. MYHRE 

Acting United States Attorney 

District of Nevada 

CRISTINA D. SILVA 

PATRICK BURNS 
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Telephone: (702) 388-6336 

Fax (702) 388-6698 

iohn.p.burns@usdoi.gov 

Attorney for the United States of America 


UNITED STATES DISTRICT COURT 
DISTRICT OF NEVADA 
-oOo- 


IN THE MATTER OF THE SEARCH OF 
INFORMATION RELATED TO THE 
ACCOUNT(S) ASSOCIATED WITH THE 
CELLULAR DEVICE BEARING IMEI 
990006880858377 THAT IS STORED AT 
A PREMISES CONTROLLED BY 
GOOGLE. 


Magistrate No. 




AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH 
WARRANT 


(Under Seal) 


STATE OF NEVADA ) 

) ss: 

COUNTY OF CLARK ) 

AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 

I, Ryan S. Burke, Special Agent, Federal Bureau of Investigation (FBI), having 

been duly sworn, hereby depose and say: 

INTRODUCTION AND AGENT BACKGROUND 

1. Your Affiant makes this affidavit in support of an application for a search 
warrant for information related to the Google account(s) associated with the cellular 
device bearing IMEI 990006880858377 [“Target Account(s)”], which are associated with 
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STEPHEN PADDOCK. This information is stored at a premises owned, maintained, 
controlled, or operated by Google, Inc. (“Google”), an American multinational technology 
based in Mountain View, California that specializes in Internet-related services and 
products. Those services include, but are not limited to, online advertising technologies, 
a search engine, email services, cloud computing, and many other services. The 
information to be searched is described in the following paragraphs and in Attachment 
“A” (attached hereto and incorporated herein by reference). This affidavit is made in 
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), 
and 2703(c)(1)(A) to require Google to disclose to the government records and other 
information in its possession, pertaining to the subscriber or customer associated with 
the Target Account. 

2. I am an “investigative or law enforcement officer of the United States” 
within the meaning of Title 18, United States Code, Section 2510(7), that is, an officer of 
the United States who is empowered by law to conduct investigations of, and to make 
arrests for, offenses enumerated in Title 18, United States Code, Section 2516. 

3. I have been employed as a Special Agent of the FBI for approximately five 
years, which began at the FBI Academy in October 2012. Upon completion of the 
academy, I was transferred to the Las Vegas Division’s white collar crime squad and 
then the human trafficking squad. Since October 2015,1 have been assigned to the Las 
Vegas Division’s violent crime/gang squad. Additionally, I have been a certified member 
of the FBI’s Cellular Analysis Survey Team since August 2015 due to my expertise in 
the field of historical cell site analysis. 
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4. During my tenure with the FBI, I have conducted surveillance, analyzed 
telephone records, interviewed witnesses, supervised activities of sources, executed 
search warrants, executed arrest warrants, and participated in court-authorized 
interceptions of wire and electronic communications. These investigative activities have 
been conducted in conjunction with a variety of investigations, to include those involving 
robbery, drug trafficking, kidnapping, murder, criminal enterprises, and more. In 
addition to my practical experiences, I received five months of extensive law enforcement 
training at the FBI Academy. 

5. The facts in this affidavit are derived from your Affiant’s personal 
observations, his training and experience, and information obtained from other agents, 
detectives, and witnesses. This affidavit is intended to show merely that there is 
sufficient probable cause for the requested warrant and does not set forth all of the 
Affiant’s knowledge about this matter. 

6. Based on your Affiant’s training and experience and the facts as set forth 
in this affidavit, there is probable cause to believe that violations of: 

a. Destruction/Damage of Aircraft or Aircraft Facilities -18 U.S.C.A. § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee - 18 U.S.C. §§ 922(a)(3) and (5); 

(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK and 

others yet unknown. There is also probable cause to search the information described in 

Attachment “A” for evidence of these crimes and information which might reveal the 
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identities of others involved in these crimes, as described in Attachment “B” (attached 
hereto and incorporated herein by reference). 

PROBABLE CAUSE 

7. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

8. LVMPD officers ultimately made entiy into the room and located an 
individual later identified as Stephen Paddock. Paddock was deceased from an apparent 
self-inflicted gunshot wound. 

9. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 
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10. On October 2,2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms. Paddock’s vehicle at Mandalay Bay, and two Nevada residences owed 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammunition and 100 
pounds of explosive material was found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of ammunition was located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

11. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

12. During the execution of the search warrant at the Mandalay Bay hotel room 
where the attack occurred, three cellular phones were seized. All of the phones are 
believed to have belonged to STEPHEN PADDOCK. Two of those phones were unlocked 
and able to be forensically examined. Neither phone contained significant information 
that allowed investigators to determine the full scope of STEPHEN PADDOCK’S 
planning and preparation for the attack. The other phone, however, a ZTE Model 
Z837VL bearing IMEI 990006880858377, was locked and investigators do not believe it 
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can be forensically examined. Investigators believe the only way to gain access to the 
content of the locked ZTE phone will be through the authorization to dem an d 
information associated with the Target Account from Google, the company which owns 
the operating system software installed on the phone. 

13. Your Affiant knows through training and experience that criminals 
typically make effort to secure and keep hidden information that may incriminate 
themselves or others. Due to the fact that two of the cellular phones were unlocked and 
the cellular phone associated with the Target Account was locked, your Affiant believes 
if there were any information related to a potential conspiracy it would be found within 
the Target Account. 

14. Your Affiant believes the requested search warrant will yield significant 
information from Google such as STEPHEN PADDOCK’S contact fist, email message 
content, IP address usage, photographs, third-party applications, and more, which may 
constitute evidence of his planning of the attack and potentially identify other 
participants in the attack. Ultimately, your Affiant strongly believes the requested 
information will lead investigators to determine the full scope of STEPHEN PADDOCK’S 
plan. 

RELEVANT TECHNICAL TERMS 

15. The following non-exhaustive list of definitions applies to this Affidavit and 
the Attachments to this Affidavit: 

a. The ‘Internet” is a worldwide network of computer systems operated 
by governmental entities, corporations, and universities. In order to access the Internet, 
an individual computer user must subscribe to an access provider, which operates a host 
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|| computer system with direct access to the Internet. The World Wide Web is a 
functionality of the Internet which allows users of the Internet to share information. 

b. “Internet Service Providers” are companies that provide access to the 
Internet. ISPs can also provide other services for their customers including website 
hosting, email service, remote storage, and co-location of computers and other 
communications equipment. ISPs offer different ways to access the Internet including 
telephone-based (dial-up), broadband-based access via a digital subscriber line (DSL) or 
cable television, dedicated circuits, or satellite-based subscription. ISPs typically charge 
a fee based upon the type of connection and volume of data (bandwidth). Many ISPs 
assign each subscriber an account name, such as a user name, an email address, and an 
email mailbox, and the subscriber typically creates a password for his/her account. 

c. “ISP Records” are records maintained by ISPs pertaining to their 
subscribers (regardless of whether those subscribers are individuals or entities). These 
records may include account application information, subscriber and billing information, 
account access information (often in the form of log files), emails, information concerning 
content uploaded and/or stored on the ISP’s servers, and other information, which may 
be stored both in computer data format and in written or printed record format. ISPs 
reserve and/or maintain computer disk storage space on their computer system for their 
subscribers’ use. This service by ISPs allows for both temporary and long-term storage 
of electronic communications and many other types of electronic data and files. 

d. “Online service providers” (also referred to here as “service 
providers”) are companies that provide online services such as email, chat or instant 
messaging, word processing applications, spreadsheet applications, presentation 


24 


7 






1 applications similar to PowerPoint, online calendar, photo storage and remote storage 

2 services. Sometimes they also can provide web hosting, remote storage, and co-location 

3 of computers and other communications equipment. Typically, each service provider 

4 assigns each subscriber an account name, such as a user name or screen name and the 

5 subscriber typically creates a password for his/her account. 

6 e. “Computer,” as used herein, is defined as “an electronic, magnetic, 

7 optical, electrochemical, or other high speed data processing device performing logical or 

8 storage functions, and includes any data storage facility or communications facility 

9 directly related to or operating in conjunction with such device.” 

10 f. A “server” is a centralized computer that provides services for other 

LI computers connected to it via a network. The other computers attached to a server are 

L2 sometimes called “clients.” For example, in a large company, it is common for individual 

L3 employees to have client computers at their desktops. When the employees access their 

L4 email, or access files stored on the network itself, those files are pulled electronically 

L5 from the server, where they are stored, and are sent to the client’s computer via the 

L6 network. Notably, servers can be physically stored in any location: it is not uncommon 

L7 for a network’s server to be located hundreds (and even thousands) of miles away from 

the client computers. 

g. “Internet Protocol address,” or “IP address,” refers to a unique 
number used by a computer to access the Internet. IP addresses can be dynamic, 
meaning that the Internet Service Provider (ISP) assigns a different unique number to 
a computer every time it accesses the Internet. IP addresses might also be static, that 
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is, an ISP assigns a user’s computer a particular IP address which is used each time the 
computer accesses the Internet. 

h. The term * domain” refers to a word used as a name for computers, 
networks, services, etc. A domain name typically represents a website, a server computer 
that hosts that website, or even some computer (or other digital device) connected to the 
internet. Essentially, when a website (or a server computer that hosts that website) is 
connected to the internet, it is assigned an IP address. Because IP addresses are difficult 
for people to remember, domain names are instead used because they are easier to 
remember than IP addresses. Domain names are formed by the rules and procedures of 
the Domain Name System (DNS). A common top level domain under these rules is “.com” 
for commercial organizations, “.gov” for the United States government, and “.org” for 
organizations. For example, www.usdoi.gov is the domain name that identifies a server 
used by the U.S. Department of Justice, and which uses IP address of 149.101.46.71. 

i. “Web hosting services” maintain server computers connected to the 
Internet. Their customers use those computers to operate websites on the Internet. 
Customers of web hosting companies place files, software code, databases, and other data 
on servers. To do this, customers typically connect from their own computers to the 
server computers across the Internet. 

j. The term “Whols” lookup refers to a search of a publicly available 
online database that lists information provided when a domain is registered or when an 
IP address is assigned. 

k. The terms “communications,” “records,” “documents,” “programs,” or 
“materials” include all information recorded in any form, visual or aural, and by any 
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means, whether in handmade form (including, but not limited to, writings, drawings, 
paintings), photographic form (including, but not limited to, pictures or videos), or 
electrical, electronic or magnetic form, as well as digital data files. These terms also 
include any applications (i.e. software programs). These terms expressly include, among 
other things, emails, instant messages, chat logs, correspondence attached as to emails 
(or drafts), calendar entries, buddy lists. 

l. “Chat” is usually a real time electronic communication between two 
or more individuals. Unlike email, which is frequently sent, then read and responded to 
minutes, hours, or even days later, chats frequently involve an immediate conversation 
between individuals, similar to a face-to-face conversation. Nearly all chat programs are 
capable of saving the chat transcript, to enable users to preserve a record of the 
conversation. By default, some chat programs have this capability enabled, while others 
do not. Many popular web-based email providers, like Google and Google, provide chat 
functionality as part of the online services they provide to account holders. 

m. “Apps or Applications” are third-party programs that may be 
installed through the Android operating system, which is owned by Google, for use on a 
cellular device. 

FACTS ABOUT GOOGLE 

16. In my training, my experience and this investigation, I have learned that 
Google owns and operates Android OS, which is an operating system found on many 
cellular devices to include the device associated with the Target Account. Through this 
operating system, users can install applications with a variety of functionalities, such as 
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various social media websites, mapping software, banking portals, etc. Records of the 

2 applications installed on a specific device are maintained by Google. 

3 17. In my training and experience, evidence of which applications were utilized 

4 by a specific device can be useful in identifying additional communication facilities, 

5 content of communications, financial account information, information related to whom 

6 the user associates with, and more. Oftentimes, an individual utilizing a Google account 
has the option to store certain information located on the device to a cloud, which Google 
also retains. All of this information can help investigators locate evidence of various 


criminal activity associated with the user. 








18. Your Affiant anticipates executing this warrant under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Google to disclose to the government copies 
of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “B.” Upon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items d escribed in Section II of Attachment “B.” 

CONCLUSION 

19. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
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18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 

REQUEST FOR SEALING 

20. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 
the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
cause to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 


Respectfully Submitted, 



Ryan S. Burke, Special Agent 
Federal Bureau of Investigation 


SWORN TO AND SUBSCRIBED 
before me this /J^av of October 2017. 
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ATTACHMENT “A” 
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ONLINE ACCOUNT TO BE SEARCHED 

1. This warrant applies to information related to the Google account 
associated with the cellular device bearing IMEI 990006880858377 (the “Target 
Account”) from its inception to present, which is stored at premises owned, maintained, 
controlled, or operated by Google, Inc., headquartered at 1600 Amphitheatre Way, 
Mountain View, California, 94043. 
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ATTACHMENT “B” 
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6 
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To the extent that the information described in Attachment A is within the 
possession, custody, or control of Google, including any Emails, records, files, logs, or 
information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 
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a. The contents of all messages and emails associated with the account, 
including copies of messages and emails sent to and from the account, draft 
messages/emails, the source and destination addresses associated with 
each message/email, the date and time at which each message/email was 
sent, and the size and length of each message/email; 

b. All records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other 
identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means 
and source of payment (including any credit or bank account number); 

c. All records or other information stored in the Online Accounts, including 
address books, contact and buddy fists, calendar data, pictures, 
applications, documents, and other files; 

d. All records pertaining to communications between Service Provider and 
any person regarding the account, including contacts with support services 
and records of actions taken. 

e. All data and contents related to the following Google Services associated 
with the Target Account: Android; Gmail; Google Calendar; Google Docs; 
Google Drive; Google Talk; Multilogin; Web History; YouTube; and all other 
applications. 

f. All information and content associated with any third-party application 
associated with the Target Account and the dates when the applications 
were installed; 
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g. Based on an analysis of cookies assigned to computers and devices that 
accessed the Target Account, identify all other Google accounts that have 
been accessed from any computers and devices that have logged into the 
Target Account. 

II. Information to be seized bv the United States 

After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present: 

a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy fists. 
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ATTACHMENT “C” 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or enciypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is enciypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized fist of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)( 1 )(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AO 93 (Rev. 1 i/13) Search and Seizure Warrant 
- ■ . = 


United States District Court 

for the 

District of Nevada 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

AMAZON ACCOUNT LINKED TO 
CENTRA! PARK1@LIVE.COM THAT IS STORED AT A 
PREMISES CONTROLLED BY AMAZON, INC. 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _*_District of _ Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A 


) 

) 

) Case No. 2:17-mj- -(^37 c 

) 

) 


1 find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


SEE ATTACHMENTS B and C 


YOU ARE COMMANDED to execute this warrant on or before .q)Q\ ( (not to exceed 14 day’s) 

n the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the w aijanj, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_|v )^VT 

□ Pursuant to 18 U.S.C. § 3103a(b), 1 find that immediate notification may 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _ 



Jnited States Magistrate Judge) 
have^n adverse result listed in 18 U.S.C. 
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ATTACHMENT “A” 


z ONLINE ACCOUNT TO BE SEARCHED 

3 

1. This warrant applies to information related to the Amazon.com account 

4 associated with centralparkl@live.com (the “Target Amazon Account”) from its inception 
to present, which is stored at premises owned, maintained, controlled, or operated by 

5 Amazon.com, Inc., headquartered at 300 Deschutes Way SW, Suite 304, Tumwater, WA 
98501. 
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ATTACHMENT “B” 



To the extent that the information described in Attachment A is within the possession, 
custody, or control ofAmazon.com, including any Emails, records, files, logs, or 
information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 

a. All names, addresses, email addresses, shipping addresses, and billing 
information associated with the Target Amazon Account; 

b. Date of account creation; 

c. All purchase history; 

d. Service usage information; 

e. All Internet Protocol Address logs and information; 

f. All messages and/or communications exchanged with Amazon.com 
representative; 

g. Any and all information, files, and data in possession of Amazon.com 
and/or any other entities controlled or operation by Amazon.com, Inc. 
related to the Target Amazon Account, 



After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present: 
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a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, fists of names, records of 
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payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. Information related to wire transfers and/or the movement, possession, or 
storage of currency and valuable items. 


11 



1 


ATTACHMENT “C” 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 


part: 


Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 


(e) Issuing the Warrant. 


(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 


8 

9 


10 

11 

12 

13 


14 

15 

16 

17 

18 


19 

20 
21 
22 

23 

24 


15 





SEALED 


Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 







21 1. Your Affiant makes this affidavit in support of an application for a search 

22 warrant for information related to the Amazon account associated with email account 

23 centralparkl@live.com (“Target Amazon Account”). The Target Amazon Account is 
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associated with STEPHEN PADDOCK and the information is stored at a premises 
owned, maintained, controlled, or operated by Amazon.com, Inc. (“Amazon”), an 
American electronic commerce and cloud computing company based in Tumwater, 
Washington. More generally, Amazon is a website that allows account holders to browse 
for and purchase a variety of goods. Separately, Amazon offers and provides internet- 
based cloud services to various individuals/entities. The information to be searched is 
described in the following paragraphs and in Attachment “A” (attached hereto and 
incorporated herein by reference). This affidavit is made in support of an application for 
a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A) to require 
Amazon to disclose to the government records and other information in its possession, 
pertaining to the subscriber or customer associated with the Target Amazon Account. 

2. I am an “investigative or law enforcement officer of the United States” 
within the meaning of Title 18, United States Code, Section 2510(7), that is, an officer of 
the United States who is empowered by law to conduct investigations of, and to make 
arrests for, offenses enumerated in Title 18, United States Code, Section 2516. 

3. I have been employed as a Special Agent of the FBI for approximately five 
years, which began at the FBI Academy in October 2012. Upon completion of the 
academy, I was transferred to the Las Vegas Division’s white collar crime squad and 
then the human trafficking squad. Since October 2015,1 have been assigned to the Las 
Vegas Division’s violent crime/gang squad. Additionally, I have been a certified member 
of the FBI’s Cellular Analysis Survey Team since August 2015 due to my expertise in 
the field of historical cell site analysis. 
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4. During my tenure with the FBI, I have conducted surveillance, analyzed 
telephone records, interviewed witnesses, supervised activities of sources, executed 
search warrants, executed arrest warrants, and participated in court-authorized 
interceptions of wire and electronic communications. These investigative activities have 
been conducted in conjunction with a variety of investigations, to include those involving 
robbery, drug trafficking, kidnapping, murder, criminal enterprises, and more. In 
addition to my practical experiences, I received five months of extensive law enforcement 
training at the FBI Academy. 

5. The facts in this affidavit are derived from your Affian t’s personal 
observations, his training and experience, and information obtained from other agents, 
detectives, and witnesses. This affidavit is intended to show merely that there is 
sufficient probable cause for the requested warrant and does not set forth all of the 
Affiant’s knowledge about this matter. 

6. Based on your Affiant’s training and experience and the facts as set forth 
in this affidavit, there is probable cause to believe that violations of: 

a. Destruction/Damage of Aircraft or Aircraft Facilities - 18 U.S.C.A § 32(a); 

b. Violence at International Airport -18 U.S.C. § 37(a)(2); and 

c. Unlawful Interstate Transport/Delivery of Firearms by Non Federal 
Firearms Licensee - 18 USC 922(a)(3) and (5). 

(hereafter, “Subject Offenses”) have been committed by STEPHEN PADDOCK and 

others yet unknown. There is also probable cause to search the information described in 

Attachment “A” for evidence of these crimes and information which might reveal the 






1 


identities of others involved in these crimes, as described in Attachment “B” (attached 
hereto and incorporated herein by reference). 
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PROBABLE CAUSE 

7. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music 
festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At 
approximately 10:08 p.m., the Las Vegas Metropolitan Police Department (LVMPD) 
received calls reporting shots had been fired at the concert and multiple victims were 
struck. LVMPD determined the shots were coming from Rooms 134 and 135 on the 32nd 
floor of the Mandalay Bay Resort and Casino, located due west of the festival rounds at 
3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated 
position which overlooks the concert venue. Witness statements and video 
footage captured during the attack indicates that the weapons being used were firing in 
a fully-automatic fashion. 

8. LVMPD officers ultimately made entiy into the room and located an 
individual later identified as STEPHEN PADDOCK. Paddock was deceased from an 
apparent self-inflicted gunshot wound. 

9. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel 
room with Paddock, and both hotel rooms were registered in his name. A player’s club 
card in name of Marilou Danley was located in Paddock’s room, and the card returned 
to the address located on Babbling Brook Street in Mesquite, Nevada. FBI Agents 
located Danley, who was traveling outside the United States at the time of the 
shooting. It was ultimately determined that Danley resided with Paddock at the 
Babbling Brook address. 
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10. On October 2,2017, search warrants were executed on Paddock’s Mandalay 
Bay hotel rooms, Paddock’s vehicle at Mandalay Bay, and two Nevada residences owned 
by Paddock: 1372 Babbling Brook Court in Mesquite, and 1735 Del Webb Parkway in 
Reno, Nevada. Officers and Agents found over 20 firearms, hundreds of rounds of 
ammunition, and hundreds of spent shell casings in the Mandalay Bay hotel rooms, in 
close proximity to Paddock’s body. Over a thousand rounds of rifle ammuni tion and 100 
pounds of explosive material were found in Paddock’s vehicle. Additional explosive 
material, approximately 18 firearms, and over 1,000 rounds of a mm unition were located 
at the Mesquite residence. A large quantity of ammunition and multiple firearms were 
recovered from the Reno residence. 

11. As of this date, 58 people have been identified to have been killed in 
Paddock’s attack and another 557 were reportedly injured. Additionally, investigators 
discovered that STEPHEN PADDOCK also utilized a firearm to shoot large fuel tanks 
on Las Vegas McCarran International Airport property. Multiple bullet holes were found 
on the tank, which investigators believe was an attempt by STEPHEN PADDOCK to 
cause the tanks to explode. 

12. In an effort to determine whether or not STEPHEN PADDOCK was 
assisted and/or conspired with unknown individuals, investigators have attempted to 
identify all of STEPHEN PADDOCK’s communication facilities. Based on a review of his 
financial accounts, email address centralnarkl@live.com (‘Email Account”) was 
determined to belong to STEPHEN PADDOCK On October 3, 2017, investigators 
requested an emergency disclosure of records from Microsoft related to the Email 
Account so it could be searched for any evidence of additional co-conspirators. Within 
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the Email Account, investigators identified the Target Amazon Account as one that 
required further investigation. 

13. Numerous emails sent from Amazon to the Email Account were discovered 
in the Email Account which were addressed by Amazon to “Stephen” and listed 
STEPHEN PADDOCK’S residence in Mesquite, Nevada as the shipping destination. For 
these reasons in conjunction with the Target Amazon Account being associated with the 
Email Account, investigators strongly believe the Target Amazon Account was controlled 
and operated by STEPHEN PADDOCK. 

14. On September 7, 2017, the Email Account received an email relating to the 
Target Amazon Account’s purchase of an EOTech 512.A65 Tactical Holographic firearm 
accessory. Within the email, which was addressed to STEPHEN PADDOCK, Amazon 
confirmed the firearm accessory would be delivered to STEPHEN PADDOCK’s 
residence. Investigators believe this piece of equipment was utilized in the attack carried 
out by STEPHEN PADDOCK. 

15. Your Affiant believes the requested search warrant will yield significant 
information from Amazon such as STEPHEN PADDOCK’s search history, purchase 
history, IP addresses, shipping addresses, payment information, and more, which may 
constitute evidence of his planning of the attack and potentially identify other 
participants in the attack. Ultimately, your Affiant strongly believes the requested 
information will lead investigators to determine the full scope of STEPHEN PADDOCK’s 
plan and/or conspiracy. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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16. Your Affiant anticipates executing this warrant under the Electronic 
Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A), by using the warrant to require Amazon to disclose to the government 
copies of the records and other information (including the content of communications) 
particularly described in Section I of Attachment “BUpon receipt of the information 
described in Section I of Attachment “B,” government-authorized persons will review 
that information to locate the items described in Section II of Attachment “B.” 

CONCLUSION 

17. Based on the forgoing, I request that the Court issue the proposed search 
warrant. This Court has jurisdiction to issue the requested warrant because it is “a court 
of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) 
& (c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). Pursuant to 
18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the 
service or execution of this warrant. 

REQUEST FOR SEALING 

18. I further request that the Court order that all papers in support of this 
application, including the affidavit and search warrant, be sealed until further order of 
the Court. These documents discuss an ongoing criminal investigation that is neither 
public nor known to all of the targets of the investigation. Accordingly, there is good 
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cause to seal these documents because their premature disclosure may seriously 
jeopardize that investigation. 
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ATTACHMENT “A” 


ONLINE ACCOUNT TO BE SEARCHED 
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1. This warrant applies to information related to the Amazon.com account 
associated with centralparkl@live.com (the “Target Amazon Account”) from its inception 
to present, which is stored at premises owned, maintained, controlled, or operated by 
Amazon.com, Inc., headquartered at 300 Deschutes Way SW, Suite 304, Tumwater, WA 
98501. 
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4 


ATTACHMENT “B” 



5 To the extent that the information described in Attachment A is within the possession, 
custody, or control ofAmazon.com, including any Emails, records, files, logs, or 

6 information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 

7 is required to disclose the following information to the government for each account or 
identifier listed in Attachment A from account inception to present: 
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a. All names, addresses, email addresses, shipping addresses, and billing 
information associated with the Target Amazon Account; 

b. Date of account creation; 

c. All purchase history; 

d. Service usage information; 

e. All Internet Protocol Address logs and information; 

f. All messages and/or communications exchanged with Amazon.com 
representative; 

g. Any and all information, files, and data in possession of Amazon.com 
and/or any other entities controlled or operation by Amazon.com, Inc. 
related to the Target Amazon Account. 
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After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); .37(a)(2) (Violence at 
International Airport); and 922(a)(3); 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee) (the “Subject Offenses”) that occur in the 
form of the following, from account inception to present: 
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a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
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payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. Information related to wire transfers and/or the movement, possession, or 
storage of currency and valuable items. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SE IZE D 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information fisted as Information to be Seized 
in Attachment B, Section II. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. examination of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessaiy to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2XA) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the ‘later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 




1 hereby attest and cetjjjyort- and correct 

United States District - n my <*». and -«™ *** 


for the 

District of Nevada 


custody. 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: stephenpaddock47 A1 


3y 


Case No. 



bde*- —c. 
:4-7-mj -00958-VCF 


CAM FERENBACH 
U.s. MAGISTRATE JUDGE 
DISTRICT OF NEVADA 

i Deputy 
Secretary 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of peijury that I have reason to believe that on the following person or property (identify the person or describe the 

AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: 

stephenpaddock47 A1 
located in the DEA 


District of 


, there is now concealed (identify the 


person or describe the property to be seized)'. 

INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK COt 
stephenpaddock47 A1 

The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more)'. 
sf evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

&f property designed for use, intended for use, or used in committing a crime; 
Slf a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 
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Code Section 

Title 26, United States Code, 
Section 5841. 


Offense Description 
Violation of National Firearms Act 


The application is based on these facts: ... ,. ... . t ,,,, 

1 believe there is probable cause to believe that in the subject accounts listed in Attachments A1 , A2 , A3 , 

“A4\ “A5" there is proof that constitutes evidence of the commission of criminal offense(s); contraband, the fruits 
of crime and things otherwise criminally possessed and been used as the means of committing criminal offense(s) 

□ Continued on the attached sheet. 


□ Delayed notice of_days (give exact ending date if more than 30 days: _ 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Applicant 's signature 


Swom to before me and signed in my presence. 


Printed name and title 


CAM FERENBACH 


Date: 


City and state: 


"3-n 

Las Vegas, Nevada 


Judge's signature 

CAM FERENBACH 



AO 93 (Rev. 1 ]/] 3) Search and Seizure Warrant 


United States District-C< 3tt#T 


on_ /d'3-n 



for the 

District of Nevada 

By 

. PERENBACH 

us. MAGISTRATE judge 
DISTRICT OF NEVADA 

i ._Dennh/ 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

) 

) 

) Case No. 

” - Secretary 

2:17-mj-00958-VCF 


stephenpaddock47 A1 ) 


) 

SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the __ District of _ Nevada 

(identify the person or describe the property to be searched and give its location)'. 

SEE ATTACHMENT A1 


1 find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS BandC 


YOU ARE COMMANDED to execute this warrant on or before _ (not to exceed l-f days) 

^5jn the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution off hewsg^nt, must prepare an inventory 
as required by law and promptly return this warrant and inventory to CAM FEnbix .. 


(United States Magistrate Judge) 


□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _—__ 


Date and time issued: /d _ ft £ 

City and state: Las Vegas, Nevada _ 


CAM'FEReNEACH 


Judge's signature 
CAMFERENBACH 





STEVEN W. MYHRE 

Acting United States Attorney 

NICHOLAS D. DICKINSON 

Assistant United States Attorney 

District of Nevada 

Nevada Bar No. 12940 

501 Las Vegas Boulevard South, Suite 1100 

Las Vegas, Nevada 89101 

PHONE: (702)388-6336 


Counsel for the United States 


l * j! r* i j 

201/OCT-3 PH 3:59 
U.S. MAGISTRATE JUDGc 


UNITED STATES DISTRICT COURT 
DISTRICT OF NEVADA 
-oOo- 

. . 2:17-mj-00958-VCF 


IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 

stephenpaddock47 A1 


IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 


Mariloudanley A2 


IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 


Mariloudanleyy A3 


Magistrate No. 


AFFIDAVIT 


(Under Seal) 


2:17-mj-00959-VCF 

Magistrate No. _ 

AFFIDAVIT 
(Under Seal) 


Magistrate No. 


2:17-mj-00960-VCF 


AFFIDAVIT 


(Under Seal) 
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IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 

Mariioudanleypaddock A4 


Magistrate 

‘ " J: 59 ' 


' a . „ ^C 


ftfodei^Seal) 


IN THE MATTER OF SEARCH OF 
INFORMATION ASSOCIATED WITH 
INSTAGRAM ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK CORPORATION: 


Magistrate No. 


2:17-mj-00962-VCF 


AFFIDAVIT 


(Under Seal) 


marilou.daniey A5 

STATE OF NEVADA ) 

) ssi 

COUNTY OF CLARK ) 

AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT 


I, Heather D. Burton, Special Agent, Federal Bureau of Investigation (FBI), having been duly 
sworn, hereby depose and say: 


INTRODUCTION AND AGENT BACKGROUND 


1. Your Affiant is a Special Agent with the FBI currently assigned to the Las Vegas, 

Nevada Division. She has been so employed for over three years. Prior to this she, was employed 
for five years as a United States Probation Officer in Memphis, Tennessee. Your Affiant is 
currently assigned to FBI Las Vegas Squad 6. Previously, she was assigned to the Las Vegas Safe 
Streets Task Force (LVSSTF) and was responsible for investigating a variety of violent crimes, to 
include bank robbery, kidnapping, extortion, robbery, caijacking, assault and murder of Federal 
Officers, racketeering related violent offenses, as well as long-term investigations into the activities 
and operations of criminal enterprises, drug trafficking organizations, and violent street gangs. 

Your Affiant has experience in conducting criminal investigations, including the investigation of 
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criminal groups and conspiracies as well as the collection of evidence and the identification and use 
of witnesses. 

2. Your Affiant makes this affidavit in support of an application for a search warrant for 
information associated with certain Instagrara, LLC (hereinafter “Insiagram”) user IDs that are 
stored at premises owned, maintained, controlled, or operated by Facebook Inc. (hereinafter 
“Facebook”), a social networking company headquartered in Menlo Park, California. The 
information to be searched is described in the following paragraphs and in Attachment A1, A2, A3, 
A4, A5 and B. This affidavit is made in support of an application for a search warrant under 18 
U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Facebook to disclose to the 
government records and other information in its possession, pertaining to the subscriber or customer 
associated with user IDs. It is submitted that the information sought through the issuance of the 
requested warrant constitutes evidence of the following offense: Violation of National Firearms Act 
- Registration of Firearms, Title 26, United States Code, Section 5841. 

3. The items to be searched are the associated Insiagram user ED names as follows: 
stephenpa ddock47 

marHondanley 

mariloudanleyy 

marilondanleypaddock 

marilou.danley 

4. Because this affidavit is being submitted for the limited purpose of securing a search 
warrant, your Affiant has not included each and every fact known to her concerning this 
investigation. Your Affiant has set forth only those facts that are necessary to establish probable 
cause for the above listed offense. The information used to support this search warrant was derived 
from reports of information obtained from witnesses as well as investigation conducted by other 
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Agents and law enforcement officers related to the incident. This affidavit contains information 
necessary to support probable cause to believe that the criminal offenses described herein were 
committed by the defendant, STEPHEN PADDOCK (hereinafter “PADDOCK”), and others yet 
unidentified, and is not intended to include each and every fact and matter observed by your Affiant 
or known to the Government. Moreover, to the extent this affidavit contains statements by witnesses, 
those statements are set forth only in part in substance and are intended to accurately convey the 
information, but not to be verbatim recitations. All noted times are approximate. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by IB U.S.C. § 2711 and 18 U.S.C. §§ 2703(a), (b)(1)(A), and 
(c)(1)(A). Specifically, the Court is a “district court of the United States (including a magistrate 

judge of such a court) that... has jurisdiction over the offense being investigated_”18 U.S.C. § 

271 l(3)(A)(i), which took place in Las Vegas, Nevada. 

BACKGROUND CONCERNING DATAGRAM 

6. Instagram, which is owned by Facebook, operates a free-access social-networking 
website of the same name that can be accessed at http://www.instagram.com. Instagram allows its 
users to create their own profile pages, which can include a short biography, a photo of themselves, 
videos and other information. Users can access Instagram through its website or by using a special 
electronic application ("app") created by the company that allows users to access the service through 
a mobile device. 

7. Instagram permits users to post photos and videos to their profiles on Instagram and 
otherwise share them with others on Instagram, as well as certain other social-media services, 
including Flickr, Facebook, and Twitter. When posting or sharing a photo or video on Instagram, a 
user can add a caption to it, can add various "tags" that can be used to search for the photo or video 
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| (e.g., a user may add the tag #vw to a photo so that people interested in Volkswagen vehicles can 
search for and find the photo), can add location information, and can add other information, as well 
as apply a variety of "filters" or other visual effects that can be used to modify the look of the posted 
photos. In addition, Instagram allows users to make comments on posted photos or videos, 
including photos or video that the user posts or posted by other users of Instagram. Users can also 
"like" photos. 

8. Upon creating an Instagram account, an Instagram user must create a unique 
Instagram username and an account password. This information is collected and maintained by 
Instagram. 

9. Instagram asks users to provide basic identity and contact information upon 
registration and also allows users to provide additional identity information for their user profile. 
This information may include the user's full name, e-mail address(es), and phone numbers), as well 
as potentially other personal information provided directly by the user to Instagram. Once an 
account is created, users may also adjust various privacy and account settings for the account on 
Instagram. This information is collected and maintained by Instagram. 

10. Instagram allows users to have "friends," which are other individuals with whom the 
user can share information without making the information public. Friends on Instagram may come 
from either contact lists maintained by the user, other third-party social media websites and 
information, or searches conducted by the user on Instagram profiles. This information is collected 
and maintained by Instagram. 

11. Instagram also allows users to "follow" another user, which means that they receive 
updates about posts made by the other user. Users may also "unfollow" users, that is, stop following 
them or block them, which prevents the blocked user from following that user. 

12. Instagram allows users to post and share various types of user content, including 
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photos, videos comments, and other materials. User content that is posted to Instagram or shared 
through Instagram is collected and maintained by Instagram. 

^ jj 13 * Instagram users can exchange private messages on Instagram with other users. These 

4 messages, which are similar to email messages, are sent to the recipient’s “Inbox” on Instagram, 

5 which also stores copies of messages sent by the recipient, as well as other information. 

6 14. Users on Instagram may also search Instagram for other users or particular types of 

7 I photos or other content. 

8 I I5 - For each user, Instagram also collects and retains information, called "log file" 

information, every time a user requests access to Instagram, whether through a web page or through 
an app. Among the log file information that Instagram's servers automatically record is the 
particular web requests, any Internet Protocol (“IP”) address associated with the request, type of 

12 browser used, any referencing/exit web pages and associated URLs, pages viewed, dates and times 

13 1 of access, and other information. 

14 8 16. Instagram also collects and maintains "cookies," which are small text files that are 

placed on a user's computer or mobile device and that allows Instagram to identify the browser or 
device's accesses to the service. 

17. Instagram also collects information on the particular devices used to access 
Instagram. In particular, Instagram may record "device identifiers," which includes data files and 
other information that may identify the particular electronic device that was used to access 
Instagram. 

1S. Instagram also collects metadata associated with user content. For example, 
Instagram collects any "hashtags" associated with user content (i.e., keywords used), "geotags" that 
mark the location of a photo and which may include latitude and longitude information, comments 
on photos, and other information. 
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19. Instagram also may communicate with the user, by email or otherwise. Instagram 
collects and maintains copies of communications between Instagram and the user. 

20. Based on the information above, the computers of Instagram are likely to contain all 
the material described above with respect to accounts with the above referenced user IDs, including 
Stephenpaddock47, mariloudanley, mariloudanleyy, mariloudanleypaddock, and 
roarilou.danley, including stored electronic communications and information concerning 
subscribers and their use of instagram, such as account access information, which would include 
information such as the IP addresses and devices used to access the account, as well as other account 
information that might be used to identify the actual user or users of the accounts at particular times. 

STATEMENT OF PROBABLE CAUSE 

21. On the evening of Sunday, October 1,2017, the Route 91 Harvest, a music festival, 
was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada 89119. At approximately 
2208 hours, the Las Vegas Metropolitan Police Department (LVMPD) received calls reporting shots 
had been fired at the concert and multiple victims were struck. LVMPD determined the shots were 
coming from Rooms 134 and 135 on the 32nd floor of the Mandalay Bay Resort and Casino, 3950 
South Las Vegas Boulevard, Las Vegas, Nevada 89119. 

22. Officers made entry into the room and located an individual later identified as 

Stephen Paddock, address 1372 Babbling Brook Court, Mesquite, Nevada 89034. 

Paddock was deceased from an apparent self-inflicted gunshot wound. 

23. Officers found multiple firearms and hundreds of rounds of ammunition in the room 
in close proximity to Paddock’s body. Additionally, investigators located over a thousand rounds of 
ammunition and explosive material in a vehicle associated with Paddock. Further, multiple firearms 
and a large quantity of ammunition were located at Paddock’s residence at 1372 Babbling Brook 
Court, Mesquite. 
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24. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel room with 
Paddock, and both hotel rooms were registered in his name. A player’s club card in name of Marilou 
Danley was located in Paddock’s room, and the card returned to the same Babbling Brook address in 
Mesquite. 

25. While monitoring an identified Facebook accounts of Marilou Danley 
(facebook.com/marilou.danley) after the shooting, LVMPD investigators noted that the account 
settings and privacy settings were changed on October 2,2017, at approximately 0030 hours. At 
approximately 0246 hours, the Facebook account was deleted. Investigators discovered the 
following additional Instagram accounts associated with Stephen Paddock and Marilou Paddock: 
stephenpaddock47, mariloudanley, mariloudanleyy, mariloudanleypaddock, and 
marilou.danley. On October 3,2017, a preservation request for all content pertaining to the these 
Instagram was submitted to Facebook to maximize the chance that the contents of the account 
remain preserved. 

26. Based on my training and experience, a person who possesses large amounts of 
firearms and ammunition obtains those items over a period of time. Thus, l am requesting that the 
search period be from September 1,2016 to the present. 

27. Based on these stated facts, it is your Affiant’s opinion that there is probable cause to 
believe that the Instagram accounts with user IDs stepheupaddock47, mariloudanley, 
mariloudanleyy, mariloudanleypaddock, and marilou.dauiey contain evidence related to 
PADDOCK’s possession of firearms in violation of Title 26, United States Code, Section 5841. 

Your Affiant also submits that a review of photos and other non-public content on the subject 
accounts will likely produce further evidence of prior and additional violations of the enumerated 
offenses. I swear, under penalty of perjury, that the foregoing is true and correct to the best of my 
knowledge and belief. 
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INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 


2 8 28 - Your Affiant anticipates executing this warrant under the Electronic Communications 

3 I Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(bXl)(A) and 2703(c)(1)(A), by using the 

4 | warrant to require Facebook to disclose to the government copies of the records and other 

5 information (including the content of communications) particularly described in Section I of 

6 Attachment “B.” Upon receipt of the information described in Section I of Attachment “B,” 

7 government-authorized persons will review that information to locate the items described in Section 


8 I] n of Attachments.” 


CONCLUSION 


29. Based on the information set forth herein. Your Affiant has probable cause to believe 
that in the subject accounts listed in Attachments “Al”, “A2”. “A3”, “A4”, “A5” there is proof that 
constitutes evidence of the commission of criminal offense(s); contraband, the fruits of crime and 
things otherwise criminally possessed; and property designed or intended for use or which is or has 
been used as the means of committing criminal offense(s). The evidence to be searched for and 
seized is set forth in Attachment "B", which is attached hereto and incorporated herein by reference. 

30. Based on the forgoing, your Affiant requests that the Court issue the proposed search 
warrant. 

31. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant 

REQUEST FOR SEALING 

31. I further request that the Court order that al! papers in support of this application, 
including the affidavit and search warrant, be sealed until turther order of the Court. These 
documents discuss an ongoing criminal investigation that is neither public nor known to all of the 
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Attachment “Al” 


Property to Be Searched 


This warrant applies to information associated with the Instagram user CDs 
stephenpaddock47, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
September 1,2016 to present. 
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Attachment “A2” 


Property to Be Searched 


This warrant applies to information associated with the Instagram user IDs mariloudaniey, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 
headquartered in Menlo Park, California for the time period beginning September 1,2016 to present. 
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Property to Be Searched 


This warrant applies to information associated with the Instagram user IDs mariloudanleyy, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 


headquartered in Menlo Park, California for the time period beginning September 1,2016 to present. 
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INSTAGRAM ACCOUNTS STORED AT 
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Mariioudanley A2 
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! (e.g., a user may add die tag #vw to a photo so that people interested in Volkswagen vehicles can 
search for and find the photo), can add location information, and can add other information, as well 
as apply a variety of"filters" or other visual effects that can be used to modify the look of the posted 
photos. In addition, Instagram allows users to make comments on posted photos or videos, 
including photos or video that the user posts or posted by other users of Instagram. Users can also 
"like" photos. 

I 8. Upon creating an Instagram account, an Instagram user must create a unique 

Instagram username and an account password. This information is collected and maintained by 

I Instagram. 

9. Instagram asks users to provide basic identity and contact information upon 
registration and also allows users to provide additional identity information for their user profile. 
This information may include the user’s full name, e-mail addresses), and phone numbers), as well 
as potentially other personal information provided directly by the user to Instagram. Once an 
account is created, users may also adjust various privacy and account settings for the account on 
Instagram. This information is collected and maintained by Instagram. 

10. Instagram allows users to have "friends," which are other individuals with whom the 
user can share information without making the information public. Friends on Instagram may come 
from either contact lists maintained by the user, other third-party social media websites and 
information, or searches conducted by the user on Instagram profiles. This information is collected 
and maintained by Instagram. 

11. Instagram also allows users to "follow" another user, which means that they receive 
updates about posts made by die other user. Users may also "unfollow” users, that is, stop following 
them or block them, which prevents the blocked user from following that user. 

12. Instagram allows users to post and share various types of user content, including 
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photos, videos comments, and other materials. User content that is posted to Instagram or shared 
through Instagram is collected and maintained by Instagram. 

13. Instagram users can exchange private messages on Instagram with other users. These 
messages, which are similar to email messages, are sent to the recipient's “Inbox” on Instagram, 
which also stores copies of messages sent by the recipient, as well as other information. 

6 14. Users on Instagram may also search Instagram for other users or particular types of 

7 I photos or other content. 

8 H I5 - For each user, Instagram also collects and retains information, called "log file" 

information, every time a user requests access to Instagram, whether through a web page or through 
an app. Among the log file information that Instagram's servers automatically record is the 
particular web requests, any Internet Protocol (“IP”) address associated with the request, type of 
browser used, any referencing/exit web pages and associated URLs, pages viewed, dates and times 

13 of access, and other information. 

14 16 - Instagram also collects and maintains "cookies," which are small text files that are 

15 placed on a user’s computer or mobile device and that allows Instagram to identify the browser or 

16 device's accesses to the service. 

17 J7 - Instagram also collects information on the particular devices used to access 

Instagram. In particular, Instagram may record "device identifiers,” which includes data files and 

! other information that may identify the particular electronic device that was used to access 
Instagram. 

18. Instagram also collects metadata associated with user content. For.example, 

Instagram collects any "hashtags" associated with user content (i.e., keywords used), "geotags" that 
mark the location of a photo and which may include latitude and longitude information, comments 
on photos, and other information. 
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19. Instagram also may communicate with the user, by email or otherwise. Instagram 
collects and maintains copies of communications between Instagram and the user. 

20. Based on die information above, the computers of Instagram are likely to contain all 
the material described above with respect to accounts with the above referenced user IDs, including 
stephenpaddock47, mariloudanley, mariloudanleyy, mariloudanleypaddock, and 
roarilou.danley, including stored electronic communications and information concerning 
subscribers and their use of Instagram, such as account access information, which would include 
information such as the IP addresses and devices used to access the account, as well as other account 
information that might be used to identify the actual user or users of the accounts at particular times. 

STATEMENT OF PROBABLE CAUSE 

21. On the evening of Sunday, October 1,2017, the Route 91 Harvest, a music festival, 
was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada 89119. At approximately 
2208 hours, the Las Vegas Metropolitan Police Department (LVMPD) received calls reporting shots 
had been fired at the concert and multiple victims were struck. LVMPD determined the shots were 
coming from Rooms 134 and 135 on the 32nd floor of the Mandalay Bay Resort and Casino, 3950 
South Las Vegas Boulevard, Las Vegas, Nevada 89119. 

22. Officers made entry into the room and located an individual later identified as 
Stephen Paddock, DObJBBHI address 1372 Babbling Brook Court, Mesquite, Nevada 89034. 
Paddock was deceased from an apparent self-inflicted gunshot wound. 

23. Officers found multiple firearms and hundreds of rounds of ammunition in the room 
in close proximity to Paddock’s body. Additionally, investigators located over a thousand rounds of 
ammunition and explosive material in a vehicle associated with Paddock. Further, multiple firearms 
and a large quantity of ammunition were located at Paddock’s residence at 1372 Babbling Brook 
Court, Mesquite. 
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24. Paddock’s Nevada driver’s license was located in the Mandalay Bay hotel room with 
Paddock, and both hotel rooms were registered in his name. A player’s club card in name of Marilou 
Danley was located in Paddock’s room, and the card returned to the same Babbling Brook address in 
Mesquite. 

I 25. While monitoring an identified Facebook accounts of Marilou Danley 

(facebook.com/marilou.danley) after the shooting, LVMPD investigators noted that the account 
settings and privacy settings were changed on October 2,2017, at approximately 0030 hours. At 
approximately 0246 hours, the Facebook account was deleted. Investigators discovered the 
following additional Instagram accounts associated with Stephen Paddock and Marilou Paddock: 

I Stephenpaddock47, mariloudanley, mariloudanleyy, mariloudanley paddock, and 
marilou.danley. On October 3,2017, a preservation request for all content pertaining to the these 
Instagram was submitted to Facebook to maximize the chance that the contents of the account 
remain preserved. 

26. Based on my training and experience, a person who possesses large amounts of 
firearms and ammunition obtains those items over a period of time. Thus, I am requesting that the 
search period be from September 1, 2016 to the present. 

27. Based on these stated facts, it is your Affiant’s opinion that there is probable cause to 
believe that the Instagram accounts with user IDs Stephen paddock47, mariloudanley, 
mariloudanleyy, mariloudanleypaddock, and marilou.danley contain evidence related to 
PADDOCK’S possession of firearms in violation of Title 26, United States Code, Section 5841. 

Your Affiant also submits that a review of photos and other non-public content on the subject 

I accounts will likely produce further evidence of prior and additional violations of the enumerated 
offenses. I swear, under penalty of peijury, that the foregoing is true and correct to the best of my 
knowledge and belief. 
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INFORMATION TO BE SEARCHED AND THINGS TO BF SEIZED 

28. Your Affiant anticipates executing this warrant under the Electronic Communications 
Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(bXl)(A) and 2703(c)(lXA), by using the 
warrant to require Facebook to disclose to the government copies of the records and other 
information (including the content of communications) particularly described in Section I of 
Attachment “B.” Upon receipt of the information described in Section I of Attachment “B," 
government-authorized persons will review that information to locate the items described in Section 
II of Attachment “B.” 

CONCLUSION 

29. Based on the information set forth herein. Your Affiant has probable cause to believe 
that in the subject accounts listed in Attachments “Al”, “A2”, “A3”, “A4” “A5” there is proof that 
constitutes evidence of the commission of criminal offense(s); contraband, the fruits of crime and 
things otherwise criminally possessed; and property designed or intended for use or which is or has 
been used as the means of committing criminal offense(s). The evidence to be searched for and 
seized is set forth in Attachment "B", which is attached hereto and incorporated herein by reference. 

30. Based on the forgoing, your Affiant requests that the Court issue the proposed search 
warrant. 


31. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 

required for the service or execution of this warrant 

REQUEST FOR SEALING 

31. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 


documents discuss an ongoing criminal investigation that is neither public nor known to all of the 
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1 targets of the investigation. Accordingly, there is good cause to seal these documents because their 
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premature disclosure may seriously jeopardize that investigation. 
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SWORN TO AND SUBSCRIBED 
before me this 3 (fey of October, 2017. 
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CAM FERENBACH 


11 UNITED STATES MAGISTRATE JUDGE 


Respectfully Submitted, 

_ UL _ 

Heather D. Burton, Special Agent 
Federal Bureau of Investigation 
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I hereby attest and certify on //) 7 

that the foregoing document is a full true and com ct 
copy of the original on file in my office, and in my lec al 
custody. 


By 




CAM FERENBACH 
U.S. MAGISTRATE JUDGE 
DISTRICT OF NEVADA 
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Attachment “Al” 


Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs 
stephenpaddock47, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
September 1,2016 to present. 
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Attachment “A 2 ” 


Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs marUoudanley, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 
headquartered in Menlo Park, California for the time period beginning September 1,2016 to present. 
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Property to Be Searched 


This warrant applies to information associated with the Instagram user IDs mariloudanleyy, 
that is stored at premises owned, maintained, controlled, or operated by Facebook, a company 
headquartered in Menlo Park, California for the time period beginning September 1,2016 to present. 
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Attachment “A4 5 


Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs 
mariloudanleypaddock, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
1 September 1,2016 to present. 
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Attachment “A5” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs and 
mariiou.danley that is stored at premises owned, maintained, controlled, or operated by Facebook, a 
company headquartered in Menlo Park, California for the time period beginning September 1, 2016 
to present 
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ATTACHMENT “B” 


Particular Things to be Seized 
I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Instagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved pursuant 
to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1, 2016 to present: 

(a) Ail contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, Instagram 
passwords, Instagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other Instagram activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending “Friend” requests; 
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(f) Al! user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

(g) All IP logs, including all records of the IP addresses that logged into the account; 

(h) All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

(i) All location data associated with the account, including geo tags; 

(j) All data and information that has been deleted by the user, 

(k) All past and present lists of friends created by the account; 

(l) All records of Instagram searches performed by the account; 

(m) The types of service utilized by the user; 

(n) The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

(o) All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

(p) All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

(q) All information regarding the particular device or devices used to login to or access 
the account, including ail device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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ATTACHMENT C 

PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy”)- The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section II. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section n. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 
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a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data fells within the items to be sei 2 ed as set forth herein: 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data fells within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 

(e) Issuing the Warrant 

(2) Contents of the Warrant 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant. The time for executing the warrant in Rule 41(e)(2)(A) and 
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1 | (f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 
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7. Pursuant to this Rule, die government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41 (e)(2XA)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to die United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 

b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return diat is to be filed with the court may be 
limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41(f)(l )(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 
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If the person from whom any Search Warrant Data was seized requests the return of any 
information in the Search Warrant Data that is not set forth in Attachment B, Section II, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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District ofNevada 
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Attachment “Al” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs 
stephenpaddock47, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
September 1,2016 to present. 
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ATTACHMENT “B” 


Particular Things to be Seized 



I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Instagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved pursuant 

I to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1,2016 to present: 

lu (a) All contact and personal identifying information, including: full name, user 

11 identification number, birth date, gender, contact e-mail addresses, Instagram 

[ 2 passwords, Instagram security questions and answers, physical address (including 

13 city, state, and zip code), telephone numbers, screen names, websites, and other 

14 personal identifiers; 

15 (b) All activity logs for the account and all other documents showing the user’s posts and 

16 other Instagram activities; 

*" (c) All photos and videos uploaded by that user ID and all photos and videos uploaded 

by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending ‘Triend” requests; 
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(0 user content created, uploaded, or shared by the account, including any comments 

made by the account on photographs or other content; 

(g) All IP logs, including all records of the IP addresses that logged into the account; 

(h) All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

(i) All location data associated with the account, including geotags: 

(j) All data and information that has been deleted by the user; 

(k) All past and present lists of friends created by the account; 

(l) All records of Instagram searches performed by the account; 

(m) The types of service utilized by the user, 

(n) The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

(o) All privacy settings and other account, settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

(p) All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

(q) All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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n. Information to be seized by the government 

AH information described above in Section I that constitutes fruits, evidence, and instrumentalities 
of violations of: 

. . Violation of National Firearms Act - Registration of Firearms, Title 26, United States Code, 

5 Section 5841. 

6 involving STEPHEN PADDOCK and others yet unidentified, including, for each user ID identified 

I 

on Attachment “A,” information pertaining to the following matters: 

(a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 
accessories, ammunition, or explosives by Paddock, including through conspiring and 
cooperating to possess, use, purchase, or sell prohibited firearms, firearms 
accessories, ammunition, or explosives. 

(b) Evidence indicating how and when the Instagram account was accessed or used, to 
determine the chronological and geographic context of account access, use, and 
events relating to the crime under investigation and to the Facebook account owner; 
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(c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 
crime under investigation; 

(d) The identity of the person(s) who created or used the user ID, including records that 
help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ID about matters 
relating to the illegal possession, purchase, use, or sale of firearms, firearms 
accessories, ammunition, or explosives, including records that help reveal their 
whereabouts. 
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The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
separately sealed, as though set forth folly herein. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy”). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy, or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section U. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 
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a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents;. 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section U. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 


(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 


(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant The time for executing the warrant in Rule 41(e)(2)(A) and 
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(f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41 (e)(2)(A)(iii) 9 within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 

b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41 (f)( 1 )(B), the inventory return that is to be filed with the court may be 
limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41 (f)(1)(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return of any 
information in the Search Warrant Data that is not set forth in Attachment B, Section II, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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to search the subject premises for evidence and instrumentalities of the subject offenses, more 
fully described in Attachment “B” (attached hereto and incorporated herein by reference). 

BACKGROUND OF INVESTIGATION 

6. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music festival, 
was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At approximately 10:08 
p.m., the Las Vegas Metropolitan Police Department (LVMPD) received calls reporting shots 
had been fired at the concert and multiple victims were struck (the “attack”). LVMPD 
determined the shots were coming from Rooms 134 and 135 on the 32 nd floor of the Mandalay 
Bay Resort and Casino, located due west of the festival grounds at 3950 South Las Vegas 
Boulevard, Las Vegas, Nevada. These rooms are an elevated position which overlooks the 
concert venue. Witness statements and video footage captured during the attack indicates that 
the weapons being used were firing in a fully-automatic fashion. 

7. LVMPD officers ultimately made entry into the room and located an individual 
later identified as Stephen Paddock. Paddock was deceased from an apparent self-inflicted 
gunshot wound. 

8. Paddock’s Nevada driver s license was located in the Mandalay Bay hotel room 
with Paddock, and both hotel rooms were registered in his name. A player’s club card in name 
of Marilou Danley was located inPaddock’s room, and the card returned to the address located 
on Babbling Brook Court in Mesquite, Nevada. FBI Agents located Danley, who was traveling 
outside the United States at the time of the shooting. It was ultimately determined that Danley 
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resided with Paddock at the Babbling Brook address. 

9. On October 2, 2017, local search warrants were obtained and executed on 
Paddock’s Mandalay Bay hotel rooms, Paddock’s vehicle parked in the Mandalay Bay parking 
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garage, and two Nevada residences owed by Paddock: 1372 Babbling Brook Court 1 , and 1735 Del 
Webb Parkway, Reno, Nevada. Pursuant to those searches. Officers and Agents found over 20 
firearms, hundreds of rounds of unfired ammunition (much of it in preloaded high-capacitv 
magazines), range finding devices, several suitcases (some partially full of pre-loaded high 

5 capacity magazines) a set of body armor, an apparent homemade gas mask, and hundreds of 

6 spent cartridge cases in the Mandalay Bay hotel rooms, in close proximity to Paddock’s body. 

7 Over a thousand rounds of rifle ammunition and a significant amount of explosive precursor 

8 material was found in Paddock's vehicle (specifically the binary explosive brand-named 

9 Tannerite). Additional explosive precursor material, approximately 18 firearms, and over 1,000 
rounds of ammunition were located at the Mesquite residence. A large quantity of ammunition 
and multiple firearms were recovered from the Reno residence. 

10. Immediately following the shooting, an extensive investigation was commenced 
which is currently being conducted jointly by LVMPD and the FBI, with the substantial support 
of numerous state, local and federal law enforcement agencies. As of this date, 58 people have 

15 been identified to have been killed in Paddock’s attack and over 500 were reportedly injured. 

16 The preliminary reviews of the crime scenes in and around the Mandalay Bay led investigators 

17 to determine that in addition to firing upon the crowds at the festival grounds. Paddock also 

18 fired several high-caliber rifle shots at large fuel tanks within the property line of the McCarran 

19 International airport property. Multiple bullet impacts were located on the tank, which 

20 investigators believe was an attempt by Paddock to explode the tanks. 

21 11. As the investigation progressed, investigators learned that Paddock planned the 

22 attack meticulously and took many methodical steps to avoid detection of his plot and to thwart 

23 the eventual law enforcement investigation that would follow. The steps included the apparent 


^n^^arr^varrant for this location was approved by 

A copy of that search warrant is attached hereto as Exhibit 1 
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destruction and/or concealment of digital storage media and the use of anonvmouslv attributed 
communications devices. Based on your Affiant’s training and experience, it is bis belief that the 
methodical nature of the planning employed by Paddock, coupled with his efforts to undermine 
the preceding investigation, are factors indicative of a level of sophistication which is commonly 
found in mass casualty events such as this. However, your Affiant notes that this finding was 
not fully-developed in this case until several days into the investigation, after the subject 
premises had been searched in the hours immediately after the attack unfolded. 

12. The investigation has also revealed that Paddock may have been treated for yet 
unidentified medical conditions, and tbat he spent significant time and expense prior to the 
attack purchasing and caching the weapons and other instrumentalities he used in the shooting. 
Some of these items included glass cutters, suitcases and a pre-paid cellular telephone. This 
cache included a substantial amount of ammunition, “Tannerite,” 2 glass cutters, numerous 
suitcases, and at least one identified pre-paid cellular telephone. 

13. Investigators are currently conducting analysis of available financial records. To 
date, this analysis has revealed that Paddock made the purchases of items used in the attack 
throughout the last approximately 12 months. A large portion of the ammunition and firearms 
accessory purchases appear to have been made through Internet based retailers. Law- 
enforcement continues to investigate the sourcing of purchases made by Paddock preceding the 
attack. 

Subsequent to her identification as Paddock’s companion and co-habitant at the 
subject premises. Marilou Danely returned to the United States and was thereafter voluntarily 
interviewed by law enforcement with her attorney present. During the interview, Danley 
corroborated much of what had been previously deduced by investigators, but she was adamant 

2 Tannerite is the brand name of a commercially available binary explosive commonly used as a reactive 
rifle target in shooting sports it can also be a precursor chemical for an improvised explosive devices. 
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that she had no pnor inclination of Paddock intentions to conduct the attack. While investigators 
obtained a DNA buccal swab sample from Danley, she spontaneously stated that her fingerprints 
would likely be found on Paddock's ammunition because she occasionally participated in loading 
magazines. Danley has not been arrested and she has agreed to cooperate with investigators. 
Although, the investigation to date has not produced any conclusive evidence that Danley aided 
Paddock, had foreknowledge of his plans, or has been deceptive with law enforcement, this aspect 
of the investigation is still the subject of intensive review. Therefore, your Affiant asserts, for 
the purposes of this affidavit, that although there is currently no evidence to suggest criminal 
involvement by Danley, investigators are not yet prepared to rule this possibility out. 

15. Investigators have reviewed the findings of the initial search of the subject 
premises and have determined that an additional, more exhaustive search is required. The 
proposed search would be focused on finding items of evidence or instrumentalities that may 
have been concealed inside or within the curtilage of the subject premises. In addition, the 
search will include a more thorough effort to identify any forensic trace evidence that may be 
located inside or within the curtilage of the subject premises. 

PROBABLE CAUSE 

16. Your Affiant believes that probable cause exists for this Court to authorize the 
proposed search, and that this probable cause is relatively unchanged from the probable cause 
that existed in the hour after the attack when the initial search was conducted. Additionally, 
information received from Danley during her interview and further investigation of the crime 
scene, as well as a fuller understanding of Paddock’s mode of planning the attack, lead your 
Affiant to believe there is probable cause that additional evidence of the subject offenses may be 
located in the subject residence. 

17. The primary identified resident, of the subject premises, Stephen Paddock, is 
deceased and as such, no longer holds standing at 1372 Babbling Brook Court. Investigators are 
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currently unable to determine Danley’s standing to provide consent to conduct this subsequent 
search. Therefore, although the FBI might already have all necessary authority to conduct the 
proposed search, your Affiant is seeking this search warrant out of an abundance of caution to 
be certain that any search conducted will comply with the Fourth Amendment and other 
applicable laws. 

CONCLUSION 

18. Based upon the aforementioned facts and circumstances, it is your Affiant's 
opinion that there is probable cause that the subject premises may contain evidence and 
instrumentalities concerning violations of the subject offenses herein. Your Affiant’s training 
and experience provides the basis for his belief that a search of the subject premises will yield 
these items. As such, your Affiant seeks this Court’s authorization to conduct a search c>f the 
subject premises as fully described in Attachment “A” for the items sought to be seized as 


described in Attachment “B.” 


Respectfully Submitted^ 


Christopher W. McPeak, Special Agent 
Federal Bureau of Investigation 


SWORN TO AND SUBSCRIBED 
before me ibis 7^ day o f Qefeber. 2017 . 


HONORABD^NANCY J. KOPPE 
UNITED STATES MAGISTRATE JUDGE 
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Attachment "B 1 


Particular Items to be Seized 

a thorough, microscopic examination and documentation of the subject premises 
to discover trace evidence, including but not limited to: fingerprints, blood, hair, 
fibers and other bodily fluid samples; 

firearms to include handguns, shotguns and rifles, spent casings or live 
ammunition for the same, firearm accessories such as magazines or cylinders, 
firearm cleaning materials, and paperwork associated with the ownership of 
firearms; 

United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds, securities, 
cashier’s checks, money drafts, and letters of credit; 

books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories, 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 

books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and /or expenditure of money; 

any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives, explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 

any and all records relating to the medical or psychological/psychiatric treatment 
of Stephen Paddock or Marilou Danley; 

all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 

cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, e-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists; 
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k. papers, tickets, notes, receipts, and other items relating to domestic and 
international travel. 

l. any and all electronic storage devices, including: computer hard drives and 
external memory devices such as floppy disks, “thumb drives” (USB electronic 
storage drives), and compact disk “CD” and/or “DVD'’ storage devices. 3 

m. records evidencing occupancy or ownership of the premises described above, 
including, but not limited to, utility and telephone bills, mail envelopes, or 
addressed correspondence; 

n. records or other items which evidence ownership or use of computer equipment 
found in the target location, including, but not limited to, sales receipts, bills for 
Internet access, and handwritten notes; 

o. any and all records pertaining to the rental of self-storage units and post office 
boxes; 

p. chemicals and other compounds which may constitute explosives or explosive 
precursors; and 

q. improvised, commercial or military grade explosive devices, detonators, initiators, 
any components thereof or any other weapon of mass destruction. 
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25 3 Electronic equipment shall be seized, but not searched. Supplemental search warrant will be requested 
prior to the searching of seized electronic items. 
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Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 



AO 3 < Rev i1/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Nevada 

in the Matter of the Search of j 

('Briefly describe (he property lo be searched ) 

or identify the person by name and address) j 

1372 BABBLING BROOK COURT, ) 

MESQUITE. COUNTY OF CLARK.STATE OF NEVADA ) 

) 

SEARCH AND SEIZURE WARRANT 

I o: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
oi the following person or property located in the District of Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A 


Case No. ■? - ,<.7 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to he seised): 

SEE ATTACHMENTS B 


><>U ARE COMMANDED to execute this warrant on or before (.. C'Cl \ c -j | cDk > \ / (not , v u 
?? in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory' to yf />.; 

•S/fTnitcd States K(e^;iJfraii' Judge) 

D Pursuant to 18 U.S.C. § 3103a(b), 1 find that immediate notification may have^tn adverse result fisted in 18 U.S.C. 

£ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

“I lor days (norto exceed 30 ) 71 until, rhe facts justifying, the later specific dale ot' 


Date and time issued: / C ij 'A 


Ciiv and state: 


Las Vegas. Nevada 
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1372 Babbling Brook Court 
Mesquite, Clark County, Nevada 

The subject premises is described as a one story, single family residence of apparent 
stucco frame construction. The premises are situated in the northeast corner Babbling Brook 
Court, which is a cul-de-sac. The premises faces approximately southwest and is located 
approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. 
The residence is painted tan and the house numbers “1372” are affixed to the exterior wall 
facing the street. 
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Attachment "B" 


a. 


b. 


c. 


d. 


Partic ular Items to be Seized 

a tho rough micros ic examination and documentation of the subject premises 
to discover trace evidence, including but not limited to: fingerprints bl<£>d hair 
fibers and other bodily fluid samples; 


firearms to include handguns, shotguns and rifles, spent casings or live 
ammunition for the same, firearm accessories such as magazines or cylinders 
firearms Cleanm ^ matenals ’ and P a P crwork associated with the ownership of 


United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds.' securities, 
cashiers checks, money drafts, and letters of credit; 


books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories, 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 


books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and /or expenditure of money: 

any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives, explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 


g. any and all records relating to the medical or psychological/psychiatric treatment 
of Stephen Paddock or Marilou Danley: 

h. all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

i. photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 

j. cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, c-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists: 
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Attachment “A4” 


Property to Be Searched 


This warrant applies to information associated with the Instagram user IDs 
mariloudanleypaddock, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
September 1,2016 to present. 
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Attachment “A5” 

Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs and 
roarilou.danley that is stored at premises owned, maintained, controlled, or operated by Facebook, a 
company headquartered in Menlo Park, California for the time period beginning September 1, 2016 


to present 
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ATTACHMENT U B” 



L Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control oflnstagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved pursuant 
to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1, 2016 to present: 

(a) All contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, Instagram 
passwords, Instagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other Instagram activities; 

(c) AH photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 
history, and pending 'Triend” requests; 
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(f) All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

(g) All IP logs, including all records of the IP addresses that logged into the account; 

(h) All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

(i) All location data associated with the account, including geo tags; 

G) All data and information that has been deleted by the user, 

(k) All past and present lists of friends created by the account; 

(l) All records of Instagram searches performed by the account; 

(m) The types of service utilized by the user; 

(n) The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

(o) All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

(p) All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

(q) AH information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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ATTACHMENT C 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
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PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Copy”). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search Warrant Data 
Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section II. The 
United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 
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4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 


19 












1 


2 

3 

4 

5 

6 
7 
S 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 


a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 

(e) Issuing the Warrant 

(2) Contents of the Warrant 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant undo- Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant. The time for executing the warrant in Rule 41(e)(2)(A) and 
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1 (f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review, 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized.... In a case involving the seizure of electronic storage media 

I or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to fee United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed. 

b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the “later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41 (f)(1)(B), the inventory return that is to be filed with the court may be 
limited to a description of fee “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41 (f)( I )(B), the government may retain a copy of that information for purposes 

I of the investigation. The government proposes that the original storage media on which the 

Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government 

e. If the person from whom any Search Warrant Data was seized requests the return of any 

information in the Search Warrant Data that is not set forth in Attachment B, Section II, that 
information will be copied onto appropriate media and returned to the person from whom the 
! information was seized. 
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SEALED 


Office of the United States Attorney 
District ofNevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 
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Property to Be Searched 

This warrant applies to information associated with the Instagram user IDs 
stephenpaddock47, that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California for the time period beginning 
September 1,2016 to present. 
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ATTACHMENT “B” 


Particular Things to be Seized 



3 | I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Instagram LLC (“Instagram”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Instagram, or have been preserved pursuant 

I to a request made under 18 U.S.C. § 2703(f) on October 3,2017. Facebook is required to disclose the 
following information to the government for each user IDs listed in Attachment A for the period of 
September 1,2016 to present: 

(a) All contact and personal identifying information, including: full name, user 
identification number, birth date, gender, contact e-mail addresses, Instagram 
passwords, Instagram security questions and answers, physical address (including 
city, state, and zip code), telephone numbers, screen names, websites, and other 
personal identifiers; 

(b) All activity logs for the account and all other documents showing the user’s posts and 
other Instagram activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them; 

(d) All profile information; status updates; links to videos, photographs, bios, articles, 
and other items; Wall postings; friend lists, including the friends’ Instagram user 
identification numbers; future and past event postings; comments; and tags; 

(e) All other records of communications and messages made or received by the user, chat 

history, and pending “Friend” requests; 
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All user content created, uploaded, or shared by the account, including any comments 
made by the account on photographs or other content; 

All IP logs, including all records of the IP addresses that logged into the account; 

All records of the account’s usage of the “Like” feature, including all Instagram posts 
and content that the user has “liked”; 

All location data associated with the account, including geotags; 

All data and information that has been deleted by the user. 

All past and present lists of friends created by the account; 

All records of Instagram searches performed by the account; 

The types of service utilized by the user, 

The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 

All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

All records pertaining to communications between Instagram and any person 
regarding the user or the user’s Instagram account, including contacts with support 
services and records of actions taken. 

All information regarding the particular device or devices used to login to or access 
the account, including all device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and instrumentalities 
of violations of: 

Violation of National Firearms Act - Registration of Firearms, Title 26, United States Code, 
Section 5841. 

involving STEPHEN PADDOCK and others yet unidentified, including, for each user ID identified 
on Attachment “A,” information pertaining to the following matters: 

(a) Evidence showing the possession, use, purchase, or sale of firearms, firearms 
accessories, ammu nition, or explosives by Paddock, including through conspiring and 
cooperating to possess, use, purchase, or sell prohibited firearms, firearms 
accessories, ammunition, or explosives. 

(b) Evidence indicating how and when the Instagram account was accessed or used, to 
determine the chronological and geographic context of account access, use, and 
events relating to the crime under investigation and to the Facebook account owner; 

(c) Evidence indicating the Instagram account owner’s state of mind as it relates to the 
crime under investigation; 

(d) The identity of the person(s) who created or used the user ID, including records that 
help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ID about matters 
relating to the illegal possession, purchase, use, or sale of firearms, firearms 
accessories, ammunition, or explosives, including records that help reveal their 
whereabouts. 

The Warrant expressly incorporates the Affidavit submitted in support of the Warrant, and 
separately sealed, as though set forth folly herein. 
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ATTACHMENT C 


PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 

PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to use 
methods and procedures that will locate and expose in the electronic data produced in response to 
this search warrant (“the Search Warrant Data”) those categories of data, files, documents, or other 
electronically stored information that are identified with particularity in the warrant, while 
minimizi ng exposure or examination of irrelevant, privileged, or confidential files to the extent 
reasonably practicable. 

1 2. When the Search Warrant Data is received, the government will make a duplicate 
copy of the Search Warrant Data (“the Search Warrant Data Cop/’). The original version of the 
Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to 
return or dispose of the Search Warrant Data; production to the defense in any criminal case if 
authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the 
Search Warrant Data and the Search Warrant Data Copy, or for any other lawful purpose. The 
original of the Search Warrant Data will not be searched or examined except to ensure that it has 
been fully and completely replicated in the Search Warrant Data Copy. 

I 3. The investigating agents will then search the entirety of the Search Warrant Data 

Copy using any and all methods and procedures deemed appropriate by the United States designed 
to identify the information listed as Information to be Seized in Attachment B, Section II. The 
| United States may copy, extract or otherwise segregate information or data listed as Information to 
be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise 
segregated will no longer be subject to any handling restrictions that might be set out in this protocol 
beyond those required by binding law. To the extent evidence of crimes not within the scope of this 
warrant appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. The Government will have ninety (90) days from receipt of the data disclosed under 
Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the 
Search Warrant Data Copy has been thoroughly and completely examined for any document, data, 
or other items identified in Attachment B, Section II as Information to be Seized, the Search Warrant 
Data Copy will be sealed and not subject to any further search or examination unless authorized by 
another search warrant or other appropriate court order. The Search Warrant Data Copy will be held 
and preserved for the same purposes identified above in Paragraph 2. 

! 5. The search procedures utilized for this review are at the sole discretion of the 
investigating and prosecuting authorities, and may include the following techniques (the following is 
a non-exclusive list, as other search procedures may be used): 
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a. examination of all of the data contained in the Search Warrant Data to view the data 
and determine whether that data falls within the items to be seized as set forth herein; 

b. searching for and attempting to recover from the Search Warrant Data any deleted, 
hidden, or encrypted data to determine whether that data falls within the list of items 
to be seized as set forth herein (any data that is encrypted and unreadable will not be 
returned unless law enforcement personnel have determined that the data is not (1) an 
instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) 
otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents;. 

e. using hash values to narrow file scope of what may be found. Hash values are under- 

inclusive, but are still a helpful tool; 



f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are likely 
to appear in the evidence described in Attachment A; and/or 

h. performing any other data analysis technique that may be necessary to locate and 
retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: 

(e) Issuing the Warrant. 

(2) Contents of die Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device 
warrant, the warrant must identify the person or property to be searched, identify any person or 
property to be seized, and designate the magistrate judge to whom it must be returned. The warrant 
must command the officer to: 

(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 41(e)(2)(A) 
may authorize the seizure of electronic storage media or the seizure or copying of electronically 
stored information. Unless otherwise specified, the warrant authorizes a later review of the media or 
information consistent with the warrant The time for executing the warrant in Rule 41(e)(2)(A) and 
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(00 X A.) refers to the seizure or on-site copying of the media or information, and not to any later 
off-site copying or review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized ... In a case involving the seizure of electronic storage media 
or the seizure or copying of electronically stored information, the inventory may be limited to 
describing the physical storage media that were seized or copied. The officer may retain a copy of 
the electronically stored information that was seized or copied. 

7. Pursuant to this Rule, the government understands and will act in accordance with the 
following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution of the 
warrant, an agent is required to file an inventory return with the Court, that is, to file an 
itemized list of the property seized. Execution of the warrant begins when the United States 
serves the warrant on the named custodian; execution is complete when the custodian 
provides all Search Warrant Data to the United States. Within fourteen (14) days of 
completion of the execution of the warrant, the inventory will be filed 

b. Pursuant to Rule 41 (e)(2)(B), Rule 41 (e)(2)(A) governs the time within which the 
electronically stored information must be seized after the issuance of the warrant and copied 
after the execution of the warrant, not the ‘later review of the media or information” seized, 
or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court may be 
limited to a description of the “physical storage media” into which the Search Warrant Data 
that was seized was placed, not an itemization of the information or data stored on the 
“physical storage media” into which the Search Warrant Data was placed; 

d. Under Rule 41 (f)(1)(B), the government may retain a copy of that information for purposes 
of the investigation. The government proposes that the original storage media on which the 
Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be 
retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return of any 
information in the Search Warrant Data that is not set forth in Attachment B, Section II, that 
information will be copied onto appropriate media and returned to the person from whom the 
information was seized. 
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to search the subject premises for evidence and instrumentalities of the subject offenses, more 
fully described in Attachment “B” (attached hereto and incorporated herein by reference). 

BACKGROUND OF INVESTIGATION 

6. On the evening of Sunday, October 1, 2017, Route 91 Harvest, a music festival, 
was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At approximately 10:08 
p.rn., the Las Vegas Metropolitan Police Department (LVMPD) received calls reporting shots 
had been fired at the concert and multiple victims were struck (the “attack”). LVMPD 
determined the shots were coming from Rooms 134 and 135 on the 32 nd floor of the Mandalay 
Bay Resort and Casino, located due west of the festival grounds at 3950 South Las Vegas 
Boulevard, Las Vegas, Nevada. These rooms are an elevated position which overlooks the 
concert venue. Witness statements and video footage captured during the attack indicates that 
the weapons being used were firing in a fully-automatic fashion. 

7. LVMPD officers ultimately made entry into the room and located an individual 
later identified as Stephen Paddock. Paddock was deceased from an apparent self-inflicted 
gunshot wound. 

8. Paddock’s Nevada drivers license was located in the Mandalay Bay hotel room 
with Paddock, and both hotel rooms were registered in his name. A player’s club card in name 
of Marilou Danley was located inPaddock’s room, and the card returned to the address located 
on Babbling Brook Court in Mesquite, Nevada. FBI Agents located Danley, who was traveling 
outside the United States at the time of the shooting. It was ultimately determined that Danley 
resided with Paddock at the Babbling Brook address. 

9. On October 2, 20X7, local search warrants were obtained and executed on 
Paddock’s Mandalay Bay hotel rooms. Paddock’s vehicle parked in the Mandalay Bay parking 
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garage, and two Nevada residences owed by Paddock: 1372 Babbling Brook Court 1 , and ] 735 Del 
Webb Parkway, Reno, Nevada, Pursuant to those searches. Officers and Agents found over 20 
firearms, hundreds of rounds of unfired ammunition (much of it in preloaded high-capacity 
magazines), range finding devices, several suitcases (some partially full of pre-loaded high 
capacity magazines) a set of body armor, an apparent homemade gas mask, and hundreds of 
spent cartridge cases in the Mandalay Bay hotel rooms, in close proximity to Paddock's body. 
Over a thousand rounds of rifle ammunition and a significant amount of explosive precursor 
material was found in Paddock’s vehicle (specifically the binary explosive brand-named 
Tannerite). Additional explosive precursor material, approximately 18 firearms, and over 1,000 
rounds of ammunition were located at the Mesquite residence. A large quantity of ammunition 
and multiple firearms were recovered from the Reno residence. 

10. Immediately following the shooting, an extensive investigation was commenced 
which is currently being conducted jointly by LVMPD and the FBI, with the substantial support 
of numerous state, local and federal law enforcement agencies. As of this date, 58 people have 
been identified to have been killed in Paddock’s attack and over 500 were reportedly injured. 
The preliminary reviews of the crime scenes in and around the Mandalay Bay led investigators 
to determine that in addition to firing upon the crowds at the festival grounds. Paddock also 
fired several high-caliber rifle shots at large fuel tanks within the property line of the McCarran 
International airport property. Multiple bullet impacts were located on the tank, which 
investigators believe was an attempt by Paddock to explode the tanks. 

11. As the investigation progressed, investigators learned that Paddock planned the 
attack meticulously and took many methodical steps to avoid detection of his plot and to thwart 
the eventual law enforcement investigation that would follow. The steps included the apparent 


JJFhe^^arrhwarrant for this location was approved by 

""" ]. A copy of that search warrant is attached hereto as Exhibit 1. 
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destruction and/or concealment of digital storage media and the use of anonymously attributed 
communications devices. Based on your Affiant’s training and experience, it is his belief that the 
methodical nature of the planning employed by Paddock, coupled with his efforts to undermine 
the preceding investigation, are factors indicative of a level of sophistication which is commonly 
found in mass casualty events such as this. However, your Affiant notes that this finding was 
not fully-developed in this case until several days into the investigation, after the subject 
premises had been searched in the hours immediately after the attack unfolded. 

12. The investigation has also revealed that Paddock may have been treated for yet 
unidentified medical conditions, and that he spent significant time and expense prior to the 
attack purchasing and caching the weapons and other instrumentalities he used in the shooting. 
Some of these items included glass cutters, suitcases and a pre-paid cellular telephone. This 
cache included a substantial amount of ammunition, “Tannerite,” 2 glass cutters, numerous 
suitcases, and at least one identified pre-paid cellular telephone. 

13. Investigators are currently conducting analysis of available financial records. To 
date, this analysis has revealed that Paddock made the purchases of items used in the attack 
throughout the last approximately 12 months. A large portion of the ammunition and firearms 
accessory purchases appear to have been made through Internet based retailers. Law 
enforcement continues to investigate the sourcing of purchases made by Paddock preceding the 
attack. 

Subsequent to her identification as Paddock’s companion and co-habitant at the 
subject premises, Marilou Danely returned to the United States and was thereafter voluntarily 
interviewed by law enforcement with her attorney present. During the interview, Danley 
corroborated much of what had been previously deduced by investigators, but she was adamant 

2 Tannerite is the brand name of a commercially available binary explosive commonly used as a reactive 
rifle target, in shooting sports it can also be a precursor chemical for an improvised explosive devices. 
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that she had no prior inclination of Paddock intentions to conduct the attack. While investigators 
obtained a DNA buccal swab sample from Danley, she spontaneously stated that her fingerprints 
would likely be found on Paddock's ammunition because she occasionally participated in loading 
magazines. Danley has not been arrested and she has agreed to cooperate with investigators. 
Although, the investigation to date has not produced any conclusive evidence that Danlev aided 
Paddock, had foreknowledge of his plans, or has been deceptive with law enforcement, this aspect 
of the investigation is still the subject of intensive review. Therefore, your Affiant asserts, for 
the purposes of this affidavit, that although there is currently no evidence to suggest criminal 
involvement by Danley, investigators are not yet prepared to rule this possibility out. 

15. Investigators have reviewed the findings of the initial search of the subject 
premises and have determined that an additional, more exhaustive search is required. The 
proposed search would be focused on finding items of evidence or instrumentalities that may 
have been concealed inside or within the curtilage of the subject premises. In addition, the 
search will include a more thorough effort to identify any forensic trace evidence that may be 
located inside or within the curtilage of the subject premises. 

PROBABLE CAUSE 

16. Your Affiant believes that probable cause exists for this Court to authorize the 
proposed search, and that this probable cause is relatively unchanged from the probable cause 
that existed in the hour after the attack when the initial search was conducted. Additionally, 
information received from Danley during her interview and further investigation of the crime 
scene, as well as a fuller understanding of Paddock’s mode of planning the attack, lead your 
Affiant to believe there is probable cause that additional evidence of the subject offenses may be 
located in the subject residence. 

17. The primary identified resident of the subject premises. Stephen Paddock, is 
deceased and as such, no longer holds standing at 1372 Babbling Brook Court. Investigators are 
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currently unable to determine Danley’s standing to provide consent to conduct this subsequent 
search. Therefore, although the FBI might already have, all necessary authority to conduct the 
proposed search, your Affiant is seeking this search warrant out of an abundance of caution to 
be certain that any search conducted will comply with the Fourth Amendment and other 
applicable laws. 


CONCLUSION 

18. Based upon the aforementioned facts and circumstances, it is your Affiant’s 
opinion that there is probable cause that the subject premises may contain evidence and 
instrumentalities concerning violations of the subject offenses herein. Your Affiant’s training 
and experience provides the basis for his belief that a search of the subject premises will yield 
these items. As such, your Affiant seeks this Court’s authorization to conduct a search of the 
subject premises as fully described in Attachment “A” for the items sought to be seized as 




Federal Bureau of Investigation 
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Attachment ’’A’ 



1372 Babbling Brook Court 
Mesquite, Clark County. Nevada 


The subject premises is described as a one story, single family residence of apparent 
stucco frame construction. The premises are situated in the northeast corner Babbling Brook 
Court, which is a cul-de-sac. The premises faces approximately southwest and is located 
approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. 
The residence is painted tan and the house numbers '‘1372” are affixed to the exterior wall 
facing the street. 
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Attachment *B' 


Particular Items to be Seized 

a thorough, microscopic examination and documentation of the subject premises 
t° discover trace evidence, including but not limited to: fingerprints, blood, hair, 
fibers and other bodily fluid samples: 

firearms to include handguns, shotguns and rifles, spent casings or live 
ammunition for the same, firearm accessories such as magazines or cylinders, 
firearm cleaning materials, and paperwork associated with the ownership of 
firearms; 

United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds, securities, 
cashiers checks, money drafts, and letters of credit; 

books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories, 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 

books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and for expenditure of money; 

any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives, explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 

any and all records relating to the medical or psychological/psychiatric treatment 
of Stephen Paddock or Marilou Danley; 

all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 

cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, e-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists; 
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k. papers, tickets, notes, receipts, and other items relating to domestic and 
international travel. 

l. any and all electronic storage devices, including: computer hard drives and 
external memory devices such as floppy disks, “thumb drives” (USB electronic 
storage drives), and compact disk “CD” and/or “DVD” storage devices. 3 

m. records evidencing occupancy or ownership of the premises described above, 
including, but not limited to, utility and telephone bills, mail envelopes, or 
addressed correspondence; 

n. records or other items which evidence ownership or use of computer equipment 
found in the target location, including, but not limited to, sales receipts, bills for 
Internet access, and handwritten notes; 

o. any and all records pertaining to the rental of self-storage units and post office 
boxes; 

p. chemicals and other compounds which may constitute explosives or explosive 
precursors; and 

q. improvised, commercial or military grade explosive devices, detonators, initiators, 
any components thereof, or any other weapon of mass destruction. 
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3 Electronic equipment shall be seized, but not searched. Supplemental search warrant will be requested 
prior to the searching of seized electronic items. 
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SEALED 


Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 






AO 93 <Rev 11/13} Search ami Seizure Warrant 


United States District Court 

for the 

District of Nevada 

in the Matter of the Search of 

(liriejlv describe the pro/terty to be searched 
or identify the person by name and address) 

1372 BABBLING BROOK COURT, 

MESQUITE, COUNTY OF CLARK.STATE OF NEVADA 

SEARCH AND SEIZURE WARRANT 

1 o: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of Nevada 

{identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A 


) 

) 

) Case No. 2:17-mj7? . jC 

) 

) 


I find that the affidavit(s). or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to he seized): 

SEE ATTACHMENTS B 


y6u ARE COMMANDED to execute this warrant on or before C cfz \ . c.-j I rJK > i / foot to exceed /4 day.') 
in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant or an officer present during the execution of the warrauL must prepare an inventory 
as required by law and promptly return this warrant and inventory to /gyi'ytA*. - )( 

tinted States Judge) 

T Pursuant to 1 8 U.S.C. § 3103a(b), I find that immediate notification may havirart adverse result listed in 18 U.S.C. 

$ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

tor days (not to exceed30) Cl until, the facts justifying, the later specific date of 


Dale and time issued: 

Ciiv and state: Las Vegas, Nevada 









Attachment "A f 


Description of Propertv/Premise to be Searched 

1372 Babbling Brook Court 
Mesquite, Clark County, Nevada 

The subject premises is described as a one story, single family residence of apparent 
stucco frame construction. The premises are situated in the northeast corner Babbling Brook 
Court, which is a cul-de-sac. The premises faces approximately southwest and is located 
approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. 
The residence is painted tan and the house numbers “1372” are affixed to the exterior wail 
facing the street. 
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Attachment "B" 


rarticui ar Items to he Seized 

a thorough microscopic examination and documentation of the subject premises 
to discover trace evidence, including but not limited to: fmgerprinj blcL hair 
fibers and other bodily fluid samples; ^ ’ ' ha,r ' 

firearms to include handguns, shotguns and rifles, spent casings or live 
mmumtion for the same firearm accessories such as magazines or cylinders 
irearm cleaning matenals, and paperwork associated with the ownership of 


c. 


d. 


United States and foreign currency, precious metals, jewelry, property deeds and 
other negotiable financial instruments including: stocks, bonds securities 
cashiers checks, money drafts, and letters of credit; 


books, records, receipts, notes, ledgers, personal checks and other papers relating 
to the transportation, ordering, and purchase of firearms, firearms accessories 
ammunition, explosives or explosives precursor materials, or material relating to 
any ideological extremism; 


e. books, records, invoices, receipts, records of real estate transactions, bank 
statements and related records, gambling receipts and records, passbooks, money 
drafts, letters of credit, money orders, bank drafts, and cashier checks, bank 
checks, safe deposit box keys, money wrappers, and other items evidencing the 
obtaining, secreting, transfer, and/or concealment and /or expenditure of money: 

f. any and all financial, credit card and bank account information including but not 
limited to bills and payment records, including those relating to the purchase of 
firearms, firearms accessories, ammunition, explosives, explosives precursor 
materials, body armor, range finding devices, scopes and other optical devices, 
glass cutters, and gas masks; 

g. any and all records relating to the medical or psychological/psychiatric treatment 
of Stephen Paddock or Marilou Danley; 

h. all types of safes and the contents thereof, including but not limited to, wall safes, 
floor safes, freestanding safes, locked strong boxes, and locked containers; 

i. photographs, including still photos, negatives, video tapes, films, undeveloped film 
and the contents therein, slides; 


j. cellular telephones address and/or telephone books, digital pagers, address and/or 
telephone books, Rolodex indices, electronic organizers, and papers reflecting 
names, addresses, telephone numbers, pager numbers, fax numbers, e-mail 
addresses, Facebook account information and other contact information related to 
co-conspirators, financial institutions, and other individuals or businesses with 
whom a financial relationship exists: 
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SEALED 


Office of the United States Attorney 
District of Nevada 

501 Las Vegas Boulevard, Suite 1100 
Las Vegas, Nevada 89101 
(702) 388-6336 



AO 93 {Rev. H,'13) Search and Seizure Warrant 



United States District Court 

for the 

District of Nevada 


Wider! 3 


& 3 


0 




In the Matter of the Search of } 

(Briefly describe the property to be searched ) 

or identify the person by name and address) j 

EMAIL ACCOUNT CENTRALPARK1@LIVE.COM THAT ) 
IS STORED AT A PREMISES CONTROLLED BY ) 

MICROSOFT. A1 ) 



Case No. 2:17-mj-01 009-NJK 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

^ ^Plication by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the __District of Nevada 

(identify the person or describe the property to be searched and give its location): 

SEE ATTACHMENT A1 


I find that die affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

SEE ATTACHMENTS B and C 


Z'OU ARE COMMANDED to execute this warrant on or before OcAtfe/ 'ZP\ (no! :o exceed ]4days) 

0 in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ NANCY ,1 KDPPF _ 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 27Cb (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

-3 f° r _days (nor to exceed 30) □ until, the facts justifying, the later specific date of __. 


Date and time issued: 




L2_ \ Z’-V />■**■ 


NANCY J. KOPPE 


Judge "s signature 

«:::r2D states magistrate judge 


,ity and state: 


Las Vegas, Nevada 


Printed name and title 







ATTACHMENT “A-l” 

ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
central parkl@live.com (the ‘Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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ATTACHMENT “B” 
Particular Things to be Seized 


I. Information to be disclosed bv the Service Provider 


To the extent that the information described in Attachments A1 and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-l and A-2 from account inception to present: 

a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all comraunications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2 . 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows lave 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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After reviewing all information described in Section I, the United States will sei: 


evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate Transport/Delivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses ) that occur in the form of the following, from account inception to present: 


a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents,” 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity m the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section H. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 

a. exa min ation of all of the data contained in the Search Warrant Data to view 
the data and determine whether that data falls within the items to be seized as set forth 
herein; 

b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel have determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 

c. surveying various file directories and the individual files they contain; 

d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

f. scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment Al and A2; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 

Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 

(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 4l(f)( 1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 
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d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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AO 9? (Rc-v. 11/13) Search aod Seizure Warrant 



United States District Court 

for the 

District of Nevada 


2HnocT 13 


Du 

I I 


5*2=30 


JJ *:p 


In the Matter of the Search of 


(Briefly describe the property to be searched ) 

or identify the person by name and address) ^ 

EMAIL ACCOUNT CENTRALPARK1@LIVE.COM THAT ) 

IS STORED AT A PREMISES CONTROLLED BY ) 

MICROSOFT. A1 ) 



Case No. 2:17-mj-01009-NJK 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ District of _ Nevada 

(identify the person or describe the property to be searched and give Us location)'. 

SEE ATTACHMENT A1 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
Jescribed above, and that such search will reveal {, identify the person or describe the property to be seized)'. 

SEE ATTACHMENTS B and C 


XO\j ARE COMMANDED to execute this warrant on or before OcAd-e, z] -zp\ 1 (not to exceed 14 days) 

0 in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ NANCY .1 KDPPF _• 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) O until, the facts justifying, the later specific date of _. 


Date and time issued: 




n 




NANCY J. KOPPE 


Las Vegas, Nevada 


Judge's signature 

«k:ted states magistrate judge 


Jty and state: 


Printed name and title 
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ATTACHMENT “A-l” 

ONLINE ACCOUNT TO BE SEARCHED 

This warrant applies to information associated with the Microsoft email account 
centralparkl@Iive.com (the “Target Account 1”) from inception to present, which is 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation, 
headquartered at 1 Microsoft Way, Redmond, Washington, 98052. 
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Particular Things to be Seized 


Information to be disclosed bv the Service Provider 


To the extent that the information described in Attachments A1 and A2 is within 
the possession, custody, or control of Microsoft, including any Emails, records, files, logs, 
or information that have been deleted but are still available to Service Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Service Provider 
is required to disclose the following information to the government for each account or 
identifier listed in Attachments A-l and A-2 from account inception to present: 


a. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any OneDrive accounts 
associated with or assigned to Target Accounts 1 and 2. 

b. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Office 360 accounts 
associated with or assigned to Target Accounts 1 and 2. 

c. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Microsoft Family 
Safety accounts or services associated with or assigned to Target Accounts 
1 and 2. 

d. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Writer accounts or services associated with or assigned to Target Accounts 
1 and 2. 

e. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live Mail 
accounts or services associated with or assigned to Target Accounts 1 and 
2 . 

f. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Photo 
Gallery accounts or services associated with or assigned to Target Accounts 
1 and 2. 

g. The contents of all communications, transactions, records, documents, 
programs, or materials stored in or associated with any Windows Live 
Messenger accounts or services associated with or assigned to Target 
Accounts 1 and 2. 
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After reviewing all information described in Section I, the United States will seize 
evidence of violations of Title 18, United States Code Sections 32(a) 
(Destruction/Damage of Aircraft or Aircraft Facilities); 37(a)(2) (Violence at 
International Airport); and 922(a)(3); and 5 (Unlawful Interstate TransportTDelivery of 
Firearms by Non Federal Firearms Licensee); and 2 (Aiding and Abetting) (the “Subject 
Offenses”) that occur in the form of the following, from account inception to present: 


a. Communications, transactions and records that may establish ownership 
and control (or the degree thereof) of the Target Account, including address 
books, contact or buddy lists, bills, invoices, receipts, registration records, 
bills, correspondence, notes, records, memoranda, telephone/address books, 
photographs, video recordings, audio recordings, lists of names, records of 
payment for access to newsgroups or other online subscription services, and 
attachments to said communications, transactions and records. 

b. Communications, transactions and records to/from persons who may be co¬ 
conspirators of the Subject Offenses, or which may identify co-conspirators. 

c. Communications, transactions and records which may show motivation to 
commit the Subject Offenses. 

d. Communications, transactions and records that relate to the Subject 
Offenses. 

e. The terms “communications,” “transactions”, “records,” “documents, 77 
“programs,” or “materials” include all information recorded in any form, 
visual or aural, and by any means, whether in handmade form (including, 
but not limited to, writings, drawings, paintings), photographic form 
(including, but not limited to, pictures or videos), or electrical, electronic or 
magnetic form, as well as digital data files. These terms also include any 
applications (i.e. software programs). These terms expressly include, among 
other things, Emails, instant messages, chat logs, correspondence attached 
as to Emails (or drafts), calendar entries, buddy lists. 
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PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED 
PURSUANT TO THIS SEARCH WARRANT 

1. In executing this warrant, the government must make reasonable efforts to 
use methods and procedures that will locate and expose in the electronic data produced 
in response to this search warrant (“the Search Warrant Data”) those categories of data, 
files, documents, or other electronically stored information that are identified with 
particularity in the warrant, while minimizing exposure or examination of irrelevant, 
privileged, or confidential files to the extent reasonably practicable. 

2. When the Search Warrant Data is received, the government will make a 
duplicate copy of the Search Warrant Data (“the Search Warrant Data Copy”). The 
original version of the Search Warrant Data will be sealed and preserved for purposes 
of: later judicial review or order to return or dispose of the Search Warrant Data; 
production to the defense in any criminal case if authorized by statute, rule, or the 
Constitution; for purposes of showing the chain of custody of the Search Warrant Data 
and the Search Warrant Data Copy; or for any other lawful purpose. The original of the 
Search Warrant Data will not be searched or examined except to ensure that it has been 
fully and completely replicated in the Search Warrant Data Copy. 

3. The investigating agents will then search the entirety of the Search 
Warrant Data Copy using any and all methods and procedures deemed appropriate by 
the United States designed to identify the information listed as Information to be Seized 
in Attachment B, Section H. The United States may copy, extract or otherwise segregate 
information or data listed as Information to be Seized in Attachment B, Section II. 
Information or data so copied, extracted or otherwise segregated will no longer be subject 
to any handling restrictions that might be set out in this protocol beyond those required 
by binding law. To the extent evidence of crimes not within the scope of this warrant 
appear in plain view during this review, a supplemental or “piggyback” warrant will be 
applied for in order to further search that document, data, or other item. 

4. Once the Search Warrant Data Copy has been thoroughly and completely 
examined for any document, data, or other items identified in Attachment B, Section II 
as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject 
to any further search or examination unless authorized by another search warrant or 
other appropriate court order. The Search Warrant Data Copy will be held and preserved 
for the same purposes identified above in Paragraph 2. 
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5. The search procedures utilized for this review are at the sole discretion of 
the investigating and prosecuting authorities, and may include the following techniques 
(the following is a non-exclusive list, as other search procedures may be used): 


3 | a. examination of all of the data contained in the Search Warrant Data to view 

4 I the data and determine whether that data falls within the items to be seized as set forth 

herein; 
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b. searching for and attempting to recover from the Search Warrant Data any 
deleted, hidden, or encrypted data to determine whether that data falls within the list 
of items to be seized as set forth herein (any data that is encrypted and unreadable will 
not be returned unless law enforcement personnel bave determined that the data is not 
(1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, 
(4) otherwise unlawfully possessed, or (5) evidence of the offenses specified above); 
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c. surveying various file directories and the individual files they contain; 
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d. opening files in order to determine their contents; 

e. using hash values to narrow the scope of what may be found. Hash values 
are under- inclusive, but are still a helpful tool; 

£ scanning storage areas; 

g. performing keyword searches through all electronic storage areas to 
determine whether occurrences of language contained in such storage areas exist that 
are likely to appear in the evidence described in Attachment A1 and A2; and/or 

h. performing any other data analysis technique that may be necessary to 
locate and retrieve the evidence described in Attachment B, Section II. 
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Return and Review Procedures 

6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant 

part: 

(e) Issuing the Warrant. 
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(2) Contents of the Warrant. 

(A) Warrant to Search for and Seize a Person or Property. Except for a tracking- 
device warrant, the warrant must identify the person or property to be searched, identify 
any person or property to be seized, and designate the magistrate judge to whom it must 
be returned. The warrant must command the officer to: 
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(i) execute the warrant within a specified time no longer than 14 days; 

(B) Warrant Seeking Electronically Stored Information. A warrant under Rule 
41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information. Unless otherwise specified, the warrant 
authorizes a later review of the media or information consistent with the warrant. The 
time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or 
on-site copying of the media or information, and not to any later off-site copying or 
review. 

(f) Executing and Returning the Warrant. 

(1) Warrant to Search for and Seize a Person or Property. 

(B) Inventory. An officer present during the execution of the warrant must prepare 
and verify an inventory of any property seized. ... In a case involving the seizure of 
electronic storage media or the seizure or copying of electronically stored information, 
the inventory may be limited to describing the physical storage media that were seized 
or copied. The officer may retain a copy of the electronically stored information that was 
seized or copied. 

7. Pursuant to this Rule, the government understands and will act in 
accordance with the following: 

a. Pursuant to Rule 41(e)(2)(A)(iii), within fourteen (14) days of the execution 
of the warrant, an agent is required to file an Inventory return with the Court, that is, 
to file an itemized list of the property seized. Execution of the warrant begins when 
the United States serves the warrant on the named custodian; execution is complete 
when the custodian provides all Search Warrant Data to the United States. Within 
fourteen (14) days of completion of the execution of the warrant, the inventory will be 
filed. 

b. Pursuant to Rule 41(e)(2)(B), Rule 41(e)(2)(A) governs the time within 
which the electronically stored information must be seized after the issuance of the 
warrant and copied after the execution of the warrant, not the “later review of the media 
or information” seized, or the later off-site digital copying of that media. 

c. Under Rule 41(f)(1)(B), the inventory return that is to be filed with the court 
may be limited to a description of the “physical storage media” into which the Search 
Warrant Data that was seized was placed, not an itemization of the information or data 
stored on the “physical storage media” into which the Search Warrant Data was placed; 


24- 








d. Under Rule 41(f)(1)(B), the government may retain a copy of that information for 
purposes of the investigation. The government proposes that the original storage media 
on which the Search Warrant Data was placed plus a full image copy of the seized Search 
Warrant Data be retained by the government. 

e. If the person from whom any Search Warrant Data was seized requests the return 
of any information in the Search Warrant Data that is not set forth in Attachment B, 
Section II, that information will be copied onto appropriate media and returned to the 
person from whom the information was seized. 
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